Swiss FADP and AI: what to check before sending data to an LLM

FADP and AI: the short answer

Sending personal data to an AI model run by a third party is data processing under the revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023. Nothing forbids it, but your company stays responsible for that data: you must know what leaves, to whom, in which country, and what the provider may do with it. What matters is not the tool, it is the category of data you send.

This article gives a three-level data grid, five questions to ask any provider and a checklist to run before going live. It is not legal advice: if a specific case is unclear, have a lawyer review it or contact the Federal Data Protection and Information Commissioner (FDPIC).

What the revised FADP changes for LLM use

A responsible person and a personal fine

The FADP protects the data of natural persons. Criminal penalties target the responsible individual, not only the company: the fine can reach CHF 250,000 for intentional breaches of certain duties, such as the duty to inform or the rules on processors. For an SME this means a director or IT lead cannot hand the topic over to “the tool”.

The duties that touch AI directly

• Duty to inform: people whose data you process must know it is processed, and for what purposes. If your customers were never told, having an LLM summarise their emails is already a problem.
• Processors: an AI vendor that processes your data on your behalf is a processor. It may only do what you would be allowed to do yourself, and you must make sure it guarantees data security.
• Disclosure abroad: sending data to a country without adequate protection requires safeguards, for example standard contractual clauses. For the United States, the Federal Council has recognised adequate protection since 15 September 2024 for companies certified under the Swiss-US Data Privacy Framework. Check that your vendor is listed.
• Impact assessment: required when processing may create a high risk for individuals, for example with sensitive data or profiling.
• Automated individual decisions: if a decision with legal effect or significant impact is taken solely by a machine, the person must be informed and be able to state their view.
• Breach notification: a data security breach likely to cause a high risk must be reported to the FDPIC as soon as possible.

The record of processing activities is in principle mandatory, with an exemption for companies under 250 employees whose processing carries limited risk. Keeping one anyway is good practice, because it forces you to list your AI uses.

Three data levels, from “free” to “forbidden without safeguards”

“Can I use ChatGPT for this?” has no single answer. It depends on what the text contains. Here is the sorting grid we use to frame a project before writing any code.

Genetic and biometric data have been sensitive data since the revision. Professional secrecy applies regardless of the FADP to professions such as lawyers and doctors: their files should not leave the firm or practice without strong safeguards.

Pseudonymising is not always enough

Replacing a name with “Client A” lowers the risk, but does not make the data anonymous if cross-checking can find the person again: a date, an amount, a job title and a city are often enough. As long as someone can reasonably identify the person, you remain within the scope of the law.

Five questions to ask any AI vendor

1. Where is the data processed and stored? A country, a cloud provider and, ideally, a specific region.
2. Is my data used to train its models? Business plans and API access usually exclude training by default, free consumer accounts less often. Read the terms of the plan you actually use.
3. How long is it kept, and can it be deleted? Conversation logs count too.
4. Which sub-processors are involved? An AI vendor often relies on a third-party host, and the chain must stay documented.
5. Is there a processor agreement and safeguards for transfers outside Switzerland? Without them, sending personal data is not defensible.

A concrete example: summarising customer emails

Take an SME that wants to summarise its support emails automatically. The content is level 2: names, addresses, sometimes order details. Before the project, check that the privacy notice mentions this use, that the chosen plan excludes training on your data, that the vendor appears on a recognised transfer list, and that emails containing health or payroll data are filtered out before sending.

The same project becomes a different topic if the tool also reads attachments from an HR department. Job applications and payslips need separate scoping, and human review if the AI contributes to a decision about a person.

The checklist before going live

• The categories of data sent are listed and sorted by level.
• Data subjects are informed of the AI use in the privacy notice.
• A processor agreement covers the vendor, and the processing country is known.
• Inputs are filtered: only the fields needed for the task are sent.
• Logs and prompts are kept for a defined period, and an owner is named.
• A breach response procedure exists, with the FDPIC as the recipient of the notification.
• A human reviews outputs that influence a decision about a person.

This check fits naturally into the rest of the process. Vendor choice follows from the criteria for choosing an AI model, input checks echo why AI automations fail on real-world data, and final validation relies on how to test an AI system before the demo.

When to self-host instead of sending to a third party

For level 3, or when volume justifies the investment, an open model hosted in Switzerland or on your own infrastructure avoids the transfer question. It does shift the responsibility: security, updates, answer quality. For most SMEs, a well-contracted business plan covers level 2 at lower cost, and controlled hosting is kept for the most sensitive files.