Contents +
An employee pastes a customer e-mail into ChatGPT to draft a reply. Another drops an order spreadsheet into it to get a summary. It is handy and fast, and in many companies nobody actually decided it. Then the question comes: is it allowed under the new Swiss Data Protection Act (nFADP, known in French as nLPD)?
The short answer: yes, AI is allowed, but the rules that apply to your data do not disappear because an AI tool processes them. Here is what you need to know, without the jargon.
No special law: the nFADP applies
Switzerland does not, for now, have a law specific to artificial intelligence. The Federal Data Protection and Information Commissioner (FDPIC) has made it clear: the nFADP, in force since 1 September 2023, applies directly to processing done with AI. As soon as a tool receives a name, an address, an e-mail or a customer file, that is personal data, and the law applies as it would to any other software.
The five points to check
- Where the data goes. Many AI tools process data outside Switzerland. That is possible towards countries the Confederation recognises as offering adequate protection, or with contractual safeguards. You still need to know where the server is, which is not always written plainly.
- What the provider does with it. Some free or consumer offers may use what you type to improve their models. Business offers usually exclude this by contract. The provider is then a processor: you need a contract stating what it may do, and nothing more.
- What your customers know. The nFADP requires you to inform the people whose data you process. If AI is part of the processing, your privacy policy must say so, and if a chatbot answers your customers, they must know they are talking to a machine.
- Who decides. A decision made solely by the machine that has significant effects on a person (rejecting an application, a loan, a file) must be disclosed, and the person can ask for a human to review it. The simplest approach: keep a human check on what matters.
- What is sensitive. Health, detailed financial data, staff files: for this data, high-risk processing may require a written impact assessment before you start. When in doubt, this data does not go into a consumer tool.
What a company can do this week
- List the AI tools already in use, including those employees adopted on their own. You cannot protect what you do not know about.
- Write a one-page usage rule: which tools, for what, and which data must never go into them.
- Switch to business accounts for the tools you keep, with training options turned off and a data processing agreement.
- Update the privacy policy on your website if AI processes your customers' data.
- Remove names when they serve no purpose. To summarise an exchange or rephrase a text, AI often does not need to know who it is about.
Sanctions under the nFADP target the responsible individuals, not only the company: fines can reach 250,000 francs for intentional breaches of certain duties, such as the duty to inform. All the more reason for the rule to be written down rather than assumed.
AI built for your data
When AI handles customer data every day (reading invoices, sorting requests, drafting replies), the safest solution is often not to go through a consumer tool. A custom automation can be hosted in Switzerland, use a model chosen for where it processes data, send only what is necessary and keep a record of every processing step.
That is how we build our automations and AI agents: every data flow is described in writing, for your records and to answer your customers. A concrete example: supplier invoice automation. To know where to start without taking risks, the process assessment identifies what is worth automating, and how to do it properly.
This article gives general guidance and does not replace legal advice for your situation.