Skip to main content

New Swiss Federal Act on Data Protection (nFADP / nLPD)

Jump directly to Avatar Method compliance under the nFADP

The New Swiss Federal Act on Data Protection (nFADP), or nLPD in French, is Switzerland’s modernized legal framework for the protection of personal data. It has been in effect since September 1, 2023, and applies to all organizations processing personal data of individuals located in Switzerland, even if the organization is based abroad.

What is personal data?​

Under the nFADP, personal data is defined as:

“All information relating to an identified or identifiable natural person.”

Examples: name, email address, AVS number (social security), IP address, location data, health information, etc.

This definition is broadly similar to that of the GDPR, though more concise in wording.

Unlike the GDPR, the nFADP does not require a specific legal basis for each processing activity. However, it mandates compliance with core principles, including:

  • Lawfulness of processing
  • Good faith and proportionality
  • Defined purpose
  • Data accuracy
  • Data security
  • Transparency toward data subjects

Explicit consent is required in certain situations, particularly when processing sensitive personal data or for specific cross-border transfers.

Processing of sensitive personal data​

The nFADP defines sensitive data as including:

  • Health data
  • Religious, philosophical, or political views
  • Trade union membership
  • Intimate or private matters
  • Criminal or administrative proceedings and sanctions
  • Social welfare measures

Such data may only be processed if:

  • Explicit consent is obtained
  • A clear legal basis permits it
  • There is an overriding public or private interest, and appropriate safeguards are in place

Status of the anonymization process​

According to the Swiss Federal Data Protection and Information Commissioner (FDPIC), data that has been anonymized such that individuals are no longer identifiable, directly or indirectly, is no longer considered personal data and thus falls outside the scope of the nFADP.

In other words, anonymization is recognized as a security measure, not a secondary data processing activity requiring new legal grounds or renewed data subject notification—if it complies with the principles of the law.

The nFADP requires that any reuse of personal data respects the original processing purpose, unless:

  • The new processing is compatible with the original purpose
  • Adequate security measures are implemented
  • There is an overriding legal or public interest

Anonymization, when used to enhance data protection, is generally seen as compatible with the original purpose.

Unlike the GDPR, the nFADP does not explicitly mention “compatible further processing” or “substantial modification,” but similar principles apply by analogy, particularly:

  • Adherence to the principle of transparency
  • Consideration of risks to the personality or fundamental rights of the data subject
  • No new notification is required if the change is a security-enhancing technical measure (such as anonymization)

Synthetic data generated through the Avatar method is no longer considered personal data under the nFADP.

The anonymization technique developed by Octopize follows a certified process that ensures irreversible de-identification. It fully complies with nFADP expectations:

  • It removes all identifiable links to individuals.
  • It qualifies as a data security measure recognized by the FDPIC.
  • It does not require renewed consent or data subject notification when aligned with the original purpose.

In summary:

  • Anonymization through the Avatar Method is compliant with the nFADP.
  • The resulting data is no longer personal.
  • No additional consent or notice is required when applying this anonymization.
  • Avatarized data is therefore outside the scope of the nFADP.