What is it? Why is it important?

The Federal Act on Data Protection (FADP) aims to protect the privacy and fundamental rights of persons from whom data is being processed.


The FADP regulates data processing:

  • That entails the collection, storage, use, revision, disclosure, archiving, or destruction of data
  • By private persons (natural and legal persons) and federal bodies


The Federal Council designates a Federal Protection and Information Commissioner (FDPIC). He / she:

  • Is a competent authority on data protection and principle of freedom of information
  • Advises private citizens on how to gain access to official documents
  • Advises administrative authorities and federal departments on FADP implementation


For data transfer outside of Switzerland, Annex 1 of the DPO contains a list of States with adequate data protection legislations in place. The FDPIC has concluded (8th Sep 20) that the US-Swiss data protection shield is not adequately robust. Data transfers to the US should be avoided, unless covered by additional protective measures.


FDPIC tasks also include to:

  • Supervise federal bodies
  • Advise and supervise private bodies
  • Assist federal and cantonal authorities on data protection
  • Provide opinion on draft confederation legislation
  • Provide opinion on code of conduct submitted by professional, industry and trade associations
  • Consult on high-risk data protection activities
  • Investigate violations of data protection regulations
  • Cooperate with data protection authorities in Switzerland and abroad
  • Inform the public on findings and recommendations
  • Maintain and publish the Register for Data Files


What do I need to do?

As a SP-INV and Site-INV handling data from study participants, you are required to know and comply with the FADP act.


Additional data protection requirements auxiliary to the FADP inlcude::

  • The Data Protection Ordinance (DPO)
  • The Ordinance on Data Protection Certification (DPCO)
  • Explicit cantonal data protection laws, which regulate data handling in the respective Swiss cantons. Ensure to include and check the applicable cantonal data protection requirements relevant to your study


Comparable to the federal level, each canton nominates a Protection and Information Commissioner (cantonal-PIC).


The General Data Protection Regulation (GDPR) is the privacy and security law of the EU. The GDPR applies:

  • To EU residents at a Swiss study site, if the study was advertised in an EU country
  • At EU study sites in a multi-centre Swiss / EU study
  • When study data are collected and/or processed in an EU country


Read the FADP law and based on your study:

  • Be familiar with the organisation of the various chapters and sections
  • As applicable, tag articles you are required to comply with
  • Ensure to include and check the applicable cantonal data protection requirements relevant to your study
  • Check out data protection requirements on the swissethics website regarding information handed out to study participants


Where can I get help?

Your local CTU can support you with experienced staff regarding this topic


GDPR – Data Protection Regulation of the EU

Swiss Law

FADP – see in particular articles

  • Art. 1 Purpose
  • Art. 2 Scope

​​​​​​​FDPIC – Information on data protection in Switzerland

DPO - Data Protection Ordinance

  • CTU – Clinical Trials Unit
  • DPO – Data Protection Ordinance
  • DPCO – Ordinance on Data Protection Certification
  • EU – European Union
  • FADP – Federal Act on Data Protection
  • FDPIC – Federal Data Protection and Information Commissioner
  • GDPR – General Data Protection Regulation
  • PIC – Protection and Information Commissioner
  • Site-INV – Site Investigator
  • SP-INV – Sponsor Investigator
Basic ↦ Ethics and Laws ↦ Swiss Law ↦ Data Protection Act

Provides some background knowledge and basic definitions

Basic Monitoring
Basic Drug or Device

Starts with a study idea

Ends after having assessed and evaluated study feasibility

Concept Drug or Device

Starts with confidence that the study is feasible

Ends after having received ethics and regulatory approval

Development Drug or Device

Starts with ethics and regulatory approval

Ends after successful study initiation

Set-Up Ethics and Laws
Set-Up Quality and Risk
Set-Up Drug or Device

Starts with participant recruitment

Ends after the last participant has completed the last study visit

Conduct Drug or Device

Starts with last study visit completed

Ends after study publication and archiving

Completion Statistics
Completion Drug or Device
Current Path (click to copy): Basic ↦ Ethics and Laws ↦ Swiss Law ↦ Data Protection Act

Please note: the Easy-GCS tool is currently under construction.