The Swiss-US Data Privacy Framework in a Nutshell and its Implications

Under the Federal Act on Data Protection (FADP), in force since 1 September 2023, personal data may be transferred abroad without additional safeguards only if the recipient country has an adequate level of data protection. The Federal Council decides which jurisdictions meet this requirement and has published a binding list of these countries in Annex 1 to the Data Protection Ordinance (DPO). If a country is not listed, the international data transfer is only permissible if additional safeguards are put in place (e.g. the EU Standard Contractual Clauses with the necessary amendments for Switzerland and transfer impact assessments) or if an exemption applies (e.g. the data subject's consent) (Art. 16, 17 FADP). Until now, the Federal Council did not deem the US to provide for an adequate level of data protection and the US was thus not listed in Annex 1 to the DPO.

The DPF was developed by the US Department of Commerce and the Swiss Federal Administration to provide reliable and compliant mechanisms for personal data transfers from Switzerland to the US. This is achieved by a certification mechanism – US companies can certify themselves under the DPF. The certification ensures that the required data protection measures and data protection guarantees are observed and put in place. In particular, the US companies are only permitted to process personal data for the purposes for which they were initially collected. Disclosure to third parties such as to non-certified companies is not permitted. In the event of access by US authorities to personal data transferred from Switzerland various safeguards are provided, including access to a redress mechanism.

Therefore, the Federal Council concluded that the DPF allows for the secure exchange of personal data between Switzerland and certified US companies, approved the corresponding amendment to the DPO at its meeting of 14 August 2024 and added the US in this context to the list of countries with adequate data protection.

What's Next and How Does This Impact You?

The amendment of the DPO will become effective on 15 September 2024. From this date, you may transfer personal data to certified US companies without having to implement additional guarantees or to rely on a statutory exemption. The US companies currently certified are listed here.

For data transfers to non-certified US companies, safeguards such as Standard Contractual Clauses and transfer impact assessments will remain necessary. We also recommend maintaining as a fallback any pre-existing safeguards put in place for certified US companies since certifications and the DPF altogether may eventually be challenged and invalidated.