revFADP vs GDPR: what your AI vendor’s DPA should cover
Swiss and EU processor rules side by side, cross-border transfers (including the Swiss-US DPF), and why a DPA alone does not solve professional secrecy.
Informational only, not legal advice. Results reflect vendors’ public statements on the date checked and our scoring rules. Verify contracts yourself before using any tool with client data.
Swiss law (revFADP, in force since 1 September 2023)
Art. 9 revFADP allows processing to be entrusted to a processor if a contract or the law provides for it, the processor only does what the controller could do itself, and no statutory or contractual duty of confidentiality prohibits it. The controller must ensure the processor can guarantee data security, and the processor may only sub-contract with the controller’s prior authorisation.
Disclosure abroad (Art. 16) is permitted without further safeguards where the Federal Council has found the destination adequate (Annex 1 to the Data Protection Ordinance). Since 15 September 2024, the USA is listed only for organisations certified under the Swiss-US Data Privacy Framework.
EU law (GDPR)
Art. 28 GDPR requires a written contract with a processor and lists its minimum content (instructions, confidentiality, security, sub-processor approval, assistance, deletion, audits). Transfers outside the EEA follow Chapter V (Art. 44 ff.). The European Commission confirmed in January 2024 that Switzerland continues to provide adequate protection.
A practical DPA checklist
- Names the revFADP as well as the GDPR, if you are a Swiss firm.
- Lists sub-processors with locations, with prior approval or objection rights.
- States the transfer mechanism for any processing outside Switzerland/EEA.
- Contains confidentiality terms suitable for secrecy-bound data (see the Art. 321 guide).
- Covers deletion, retention by model providers and audit rights.
Because Art. 9 revFADP is subject to confidentiality duties, a standard DPA does not by itself answer the professional-secrecy question.