As Artificial Intelligence becomes increasingly integrated into business operations, companies in Switzerland must navigate not only the technological landscape but also the robust legal framework protecting personal data. The revised Federal Act on Data Protection (FADP), effective since September 2023, sets clear requirements that directly impact how AI solutions are designed, developed, and deployed ([Adnovum, 2023](https://www.adnovum.com/blog/swiss-federal-act-on-data-protection-2023)).

At Fanktank, building reliable and secure systems is core to our philosophy – it's part of the Swiss precision we bring to AI. Ensuring compliance with the FADP isn't just a legal necessity; it's fundamental to building trust with your customers and employees when using powerful AI technologies.

This post outlines key FADP considerations for businesses implementing AI solutions in Switzerland. *(Disclaimer: This is informational, not legal advice. Always consult with a qualified legal professional for specific compliance guidance.)*

Key FADP Principles Applied to AI

The FADP mandates several core principles that are highly relevant to AI systems processing personal data ([SIDD, 2025](https://www.sidd.swiss/en/news/artificial-intelligence-and-data-protection-in-switzerland-challenges-and-solutions)):

1. **Lawfulness, Good Faith, Proportionality & Transparency:** * **AI Context:** Clearly inform individuals how their data is being used by AI systems. Avoid deceptive practices. Only collect and process data necessary for the specific, defined purpose of the AI application. Ensure the AI's processing is proportionate to the goal. * **Action:** Update privacy policies, provide clear notifications, design AI systems with specific goals, avoid unnecessary data collection. 2. **Purpose Limitation:** * **AI Context:** Data collected for one purpose (e.g., order processing) generally cannot be repurposed for unrelated AI training or profiling without specific consent or legal basis. * **Action:** Clearly define the purpose of your AI system *before* collecting data. Implement technical measures to prevent data misuse ([FDPIC, 2025](https://www.edoeb.admin.ch/en/conclusion-investigation-x-grok)). 3. **Data Minimisation:** * **AI Context:** Collect only the personal data strictly necessary for the AI model to function effectively for its defined purpose. Avoid collecting excessive data "just in case." * **Action:** Design data collection processes carefully. Use anonymization or pseudonymization techniques where possible before feeding data into AI models, especially for training. 4. **Accuracy:** * **AI Context:** Inaccurate input data can lead to biased or incorrect AI outputs. Take reasonable steps to ensure the accuracy of personal data used by AI. Provide mechanisms for individuals to correct their data. * **Action:** Implement data validation checks. Offer data subject access and correction rights ([Global Legal Post, 2024](https://www.globallegalpost.com/lawoverborders/artificial-intelligence-1549732605/switzerland-740152114)). 5. **Security:** * **AI Context:** Protect personal data processed by AI systems against unauthorized access, alteration, disclosure, or destruction through appropriate technical and organizational measures (TOMs). This includes securing training data, models, APIs, and outputs. * **Action:** Implement access controls, encryption, regular security audits, secure development practices, and choose AI partners/platforms with strong security credentials. Our [Custom AI Development](/services/custom-dev) emphasizes secure design ([Federal Office of Justice, 2024](https://cnai.swiss/wp-content/uploads/2024/01/Fact-sheet-on-the-use-of-generative-AI-tools-in-the-Federal-Administration_V1.2_EN_clear.pdf)). 6. **Data Subject Rights:** * **AI Context:** Individuals have rights (access, rectification, erasure, objection) regarding their data, even when processed by AI. You need processes to handle these requests effectively. Explaining complex AI decisions may also be required (transparency). * **Action:** Establish clear procedures for handling data subject requests related to AI systems. Document AI decision-making processes where feasible ([SIDD, 2025](https://www.sidd.swiss/en/news/data-protection-in-the-era-of-artificial-intelligence-opportunities-risks)).

Specific AI Implementation Considerations under FADP

**Training Data:** If using personal data for training custom models, ensure you have a valid legal basis (e.g., consent, overriding interest). Anonymize or pseudonymize data whenever possible. Document data sources and processing steps ([FDPIC, 2025](https://www.edoeb.admin.ch/en/conclusion-investigation-x-grok)).
**Third-Party AI Services/APIs:** When using external AI providers (like OpenAI, Anthropic, etc.), conduct due diligence:
Review their data processing agreements (DPAs).
Understand where data is processed and stored (data residency).
Check their security certifications and FADP/GDPR compliance statements.
Configure services for maximum privacy where available (e.g., zero data retention policies) ([SBFI, 2024](https://www.bakom.admin.ch/dam/bakom/en/dokumente/KI/Auslegeordnung%20zur%20Regulierung%20von%20%20k%C3%BCnstlicher%20Intelligenz_def.pdf.download.pdf/Overview.pdf)).
**Automated Decision-Making:** If AI makes decisions with significant legal or other impacts on individuals, FADP requires transparency and often the right for human review. Clearly disclose when such automated decisions occur ([White & Case LLP, 2024](https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-switzerland)).
**Data Protection Impact Assessments (DPIA):** For high-risk AI processing (e.g., large-scale processing of sensitive data, systematic monitoring), a DPIA is often mandatory under FADP to identify and mitigate risks ([Swiss Confederation, 2020](https://www.sbfi.admin.ch/dam/sbfi/en/dokumente/2021/05/leitlinien-ki.pdf.download.pdf/leitlinien-ki_e.pdf)).
**Cross-Border Data Transfers:** If data is transferred outside Switzerland (e.g., to cloud AI providers), ensure transfers comply with FADP requirements regarding adequate data protection levels in the destination country or use appropriate safeguards (like Standard Contractual Clauses) ([Federal Council, 2025](https://www.lenzstaehelin.com/news-and-insights/browse-thought-leadership-insights/insights-detail/switzerland-outlines-regulatory-approach-to-artificial-intelligence/)).

![FADP Outline](/images/blog/2025-03-15/fadp-overview.png)

Building Compliant AI with Fanktank

Compliance isn't an afterthought; it's integral to responsible AI deployment. We help our clients:

Design AI solutions with privacy principles ("Privacy by Design").
Select technologies and configurations that align with FADP requirements.
Implement appropriate security measures.
Navigate the considerations when using third-party AI services.

While we provide the technical expertise, partnering with your legal counsel ensures full compliance.

**Don't let data protection concerns hinder your AI ambitions. We can help you build powerful AI solutions that respect Swiss privacy standards.**

[Discuss Your Project Securely](/contact)

References

[Adnovum, 2023] ["What is FADP?"](https://www.adnovum.com/blog/swiss-federal-act-on-data-protection-2023), Adnovum. *(Explains key changes in the revised FADP and its implications for AI processing.)*
[SIDD, 2025] ["AI & Data Protection in Switzerland"](https://www.sidd.swiss/en/news/artificial-intelligence-and-data-protection-in-switzerland-challenges-and-solutions), SIDD. *(Analyzes challenges and strategies for AI data protection compliance under FADP.)*
[FDPIC, 2025] ["Preliminary Investigation into AI Use of Personal Data"](https://www.edoeb.admin.ch/en/conclusion-investigation-x-grok), FDPIC. *(Covers investigation findings on AI training with personal data.)*
[Global Legal Post, 2024] ["AI – Law Over Borders: Switzerland"](https://www.globallegalpost.com/lawoverborders/artificial-intelligence-1549732605/switzerland-740152114), Global Legal Post. *(Explores how Swiss AI laws align with international privacy standards.)*
[Federal Office of Justice, 2024] ["Fact Sheet on GenAI Tools"](https://cnai.swiss/wp-content/uploads/2024/01/Fact-sheet-on-the-use-of-generative-AI-tools-in-the-Federal-Administration_V1.2_EN_clear.pdf), FOJ. *(Outlines official guidance on using AI tools responsibly in federal operations.)*
[SIDD, 2025] ["Data Protection in the Era of AI"](https://www.sidd.swiss/en/news/data-protection-in-the-era-of-artificial-intelligence-opportunities-risks), SIDD. *(Covers risks, rights, and transparency obligations in AI systems.)*
[SBFI, 2024] ["Overview of AI Regulation"](https://www.bakom.admin.ch/dam/bakom/en/dokumente/KI/Auslegeordnung%20zur%20Regulierung%20von%20%20k%C3%BCnstlicher%20Intelligenz_def.pdf.download.pdf/Overview.pdf), SBFI. *(Compares regulatory AI frameworks internationally, with focus on Switzerland.)*
[White & Case LLP, 2024] ["AI Regulatory Tracker – Switzerland"](https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-switzerland), White & Case. *(Summarizes Swiss legal developments related to AI.)*
[Swiss Confederation, 2020] ["AI Guidelines for the Confederation"](https://www.sbfi.admin.ch/dam/sbfi/en/dokumente/2021/05/leitlinien-ki.pdf.download.pdf/leitlinien-ki_e.pdf), Swiss Confederation. *(Outlines ethical and legal frameworks for AI use.)*
[Federal Council, 2025] ["Switzerland’s Regulatory AI Strategy"](https://www.lenzstaehelin.com/news-and-insights/browse-thought-leadership-insights/insights-detail/switzerland-outlines-regulatory-approach-to-artificial-intelligence/), Federal Council. *(Explains how Switzerland plans to adopt sector-specific AI regulation and align with European frameworks.)*