nFADP: what it means for a small company
The revised Swiss data protection act (nLPD in French, nFADP in English) has been in force since September 2023. Here is what official sources say, in plain words.
Published 16.10.2026
250,000
francs: maximum criminal fine, aimed mainly at individuals
50,000
francs: the ceiling under which the company itself can be fined
Who can be fined
According to the Federal Data Protection and Information Commissioner (FDPIC), fines can reach 250,000 francs. They target primarily the responsible individuals, only for intentional acts, and cover among other things failing to protect data with appropriate technical and organisational measures or failing to inform. The company itself can be fined when the fine would not exceed 50,000 francs and identifying the responsible person would require disproportionate effort.
What a small company has to do
The federal SME portal mentions keeping a record of processing activities, with an exemption for SMEs with limited risk, and notifying the FDPIC quickly of data security breaches.
What this page does not say
Fines are only part of the picture: civil liability follows different rules. This page summarises official sources and is not legal advice. For your own situation, ask a lawyer.
Knowing which personal data you hold, where it is and who can reach it is the practical base of any preparation for the act.
Sources
We summarise; we do not reproduce. Sources consulted on 16.10.2026. These texts inform: they are not legal advice, and an average figure does not predict what will happen to a given company.