AI and Data Privacy: Swiss Compliance Guide

AI and Data Privacy: Swiss Compliance Guide

The Swiss Data Protection Act (revDSG) sets clear requirements for handling personal data. When you use AI that processes customer data, you must meet these requirements. This guide explains the relevant rules in understandable language and gives you a practical compliance checklist.

The Revised Data Protection Act (revDSG) Overview

Since September 1, 2023, the revised Data Protection Act applies. Key changes from the old law: Extended information obligations mean you must inform data subjects about processing their data. Privacy by Design requires data protection to be built into technology from the start. Data protection impact assessment for high risks means a formal risk assessment is required for particularly risky processing. Breach notification obligation requires fastest possible notification to the FDPIC. Stricter sanctions bring fines up to CHF 250,000 for responsible persons.

What This Means for Your AI Projects

In the AI context, four principles are particularly relevant. Purpose limitation means data may only be used for the purpose for which it was collected. If you collected customer data for order processing, you cannot simply use it for AI-based marketing analysis. Solution: clearly define the processing purpose and obtain consent if needed.

Data minimization requires processing only data that is actually necessary. If your AI needs the delivery address for route optimization, it does not need to know the birth date simultaneously. Solution: restrict AI access to minimally necessary data.

Transparency requires that data subjects must know their data is processed with AI and what happens. Solution: add a paragraph about AI processing to your privacy policy.

Data security requires appropriate technical and organizational measures to protect data. Solution: encryption, access control, logging, and regular security reviews.

Data Protection Impact Assessment (DPIA)

A DPIA is required when AI processing is likely to pose a high risk to the personality or fundamental rights of data subjects. Typical cases: high-risk profiling, automated individual decisions, extensive processing of particularly sensitive data. For most SME AI projects like order automation or customer service, a formal DPIA is not required. However, we recommend conducting a simplified risk assessment for every project.

Swiss Servers: A Must?

The revDSG does not strictly require Swiss servers, but data must be processed in a country with "adequate data protection level." The EU and EEA are considered adequate, the USA only under certain conditions. Our recommendation for SMEs: use Swiss servers. It simplifies compliance, strengthens customer trust, and avoids complex international data protection issues.

Compliance Checklist for AI Projects

Use this checklist for every AI project: Is the processing purpose clearly defined and documented? Is only necessary data processed? Is the privacy policy updated? Are data subjects informed? Is consent required and obtained? Is data encrypted at rest and in transit? Is there access control? Are accesses logged? Is data processing on Swiss or EU servers? Is there a process for information and deletion requests? Is there a data processing agreement with the AI partner? Has a risk assessment been conducted?

Conclusion

Data protection and AI are not mutually exclusive. With the right measures (Swiss servers, encryption, transparency, and data minimization) you can use AI while protecting your customers' data. Most SME AI projects can be made privacy-compliant with manageable effort.