AI in SMEs: what Swiss data protection law requires

In brief

The revised Swiss Federal Act on Data Protection (revFADP) has been in force since 1 September 2023. It is technology-neutral and therefore also applies to AI. The Federal Data Protection and Information Commissioner (FDPIC) has stated explicitly that current law applies directly to AI-supported data processing. So no new AI law is needed for obligations to exist.

For an SME, this does not mean doing without AI. It means clarifying a few things before using it.

Question 1: Which data am I entering?

It is simplest if no personal data goes into an AI tool at all. Writing an advertising text or a general template is unproblematic. It is a different matter if you paste in customer emails, quotes with names or personnel files.

Particularly sensitive personal data, such as health data or information on religious beliefs, is especially delicate. It does not belong in a freely available AI tool.

Question 2: Where is the data processed?

Many AI providers process data in the USA or other countries. The revFADP allows data to be disclosed abroad if the country offers adequate data protection. The Federal Council specifies these countries in a list. For the USA, this only applies to companies certified under the Swiss-U.S. Data Privacy Framework.

Other providers require additional safeguards, typically standard contractual clauses. So check where your provider is based and which contracts it offers.

Question 3: May the provider train on my data?

With free versions, many providers reserve the right to use inputs to improve their models. Business and enterprise versions usually exclude this contractually and offer a data processing agreement.

Such an agreement is important: when an external provider processes personal data on your behalf, your company remains responsible and must ensure that the provider only processes the data in the way you yourself would be allowed to.

Question 4: Do the people concerned know about it?

The revFADP requires transparency. Anyone who collects personal data must inform the people concerned, usually through the privacy policy. If you start using AI tools with customer data, this belongs in it – including the countries the data goes to.

If an AI independently makes decisions with significant consequences for a person, such as an automatic rejection, the people concerned must be informed and be able to present their point of view on request.

Checklist for your SME

• Record which AI tools are already being used in your company, including privately.
• Use business versions with company accounts for work, not private free accounts.
• Check the server location, the data processing agreement and the opt-out from training.
• Set out in a short AI policy which data may go into which tools.
• Update your privacy policy.
• Always have important results checked by a person.

And if you ignore it?

The revFADP provides for fines of up to CHF 250,000, for example for wilful breaches of the duty to inform. A Swiss peculiarity: it is primarily the responsible individuals who are fined, not the company. The loss of trust when customer data ends up where it doesn’t belong weighs at least as heavily.

This article provides a general overview and is not a substitute for legal advice. For binding information on your case, please consult a data protection law specialist.