Swiss-US Privacy Framework

A framework similar to the EU-US DPF that provides a legal mechanism for transferring personal data from Switzerland to the United States. Participating US companies must self-certify to the Swiss-US Privacy Framework principles, which include requirements for data protection, transparency, and individual rights. Organizations must renew their certification annually.

JurisdictionSwitzerland
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Here is a comprehensive analysis of the Swiss-US Privacy Framework:

Key Requirements

The main requirements of the Swiss-US Privacy Framework include:

  • Self-certification: Organizations must self-certify their adherence to the Framework Principles with the U.S. Department of Commerce and publicly commit to comply with them. Swiss-US DPF Overview
  • Notice: Organizations must inform individuals about their participation in the Framework, the types of data collected, and how it will be used. Swiss-US DPF Principles
  • Choice: Individuals must be given the opportunity to opt out of having their personal data disclosed to third parties or used for purposes materially different from those for which it was originally collected. Swiss-US DPF Principles
  • Security: Organizations must take reasonable and appropriate measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration and destruction. Swiss-US DPF Principles
  • Data Integrity and Purpose Limitation: Personal data must be limited to what is relevant for the purpose of processing, and organizations must take reasonable steps to ensure data is reliable, accurate, complete and current. Swiss-US DPF Principles
  • Access: Individuals must have access to personal information about them and be able to correct, amend or delete inaccurate information. Swiss-US DPF Principles
  • Recourse, Enforcement and Liability: Organizations must provide robust mechanisms for ensuring compliance with the Principles and recourse for individuals affected by non-compliance. Swiss-US DPF Principles

Compliance Challenges

Common challenges organizations face include:

  • Ensuring ongoing compliance: As business practices and data uses change, maintaining compliance with all Principles can be challenging. TrustArc Blog on DPF Compliance
  • Managing data subject requests: Providing individuals with access to their data and honoring choices about its use can be operationally complex. IAPP Article on Data Subject Rights

Implementation Best Practices

To implement the Swiss-US Privacy Framework effectively:

  • Conduct a thorough data mapping exercise to understand what Swiss personal data you collect and how it's used. IAPP Data Mapping Guidance

Recent Updates

  • Organizations previously certified under the Swiss-US Privacy Shield must update their privacy policies to reference the new Swiss-US Data Privacy Framework by October 10, 2023. DPF Transition Guidance

Related Regulations

  • EU-US Data Privacy Framework: Similar framework for EU-US data transfers. The Swiss-US DPF closely aligns with this framework. EU-US DPF Overview
  • Swiss Federal Act on Data Protection (FADP): The primary Swiss data protection law that the Swiss-US DPF complements. FADP Text
  • EU General Data Protection Regulation (GDPR): While not directly applicable, many Swiss-US DPF principles align with GDPR requirements. GDPR Text

Industry Impact

The Swiss-US DPF particularly impacts:

  • Pharmaceutical and healthcare: Supports clinical trial data transfers and research collaboration. Interpharma Statement

Sources

Recent developments

  • — Nurix updated its Data Privacy Framework Policy on December 23, 2025, certifying adherence to the Swiss-US DPF Principles for processing personal data received from Switzerland, supplementing its existing privacy notices. (source)
  • — Switzerland's government officially endorsed American cloud services under the Swiss-US Privacy Framework amid ongoing privacy concerns, highlighting tensions in transatlantic data flows. (source)

Read the full guide to Swiss-US Privacy Framework

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates