In accordance with the Federal Act on Data Protection (FADP), any person may request information from the controller of a data file as to whether their personal data is being processed and may, if necessary, have the data corrected or destroyed. This right to information allows everyone to maintain control over the data collected about them. It is key to enabling those affected to assert their rights under the law and ensures transparency regarding what use is made of the data. Nevertheless, each person must take action themselves to exercise this right.
Right to information
The FADP sets out a non-exhaustive list of information that must always be provided to the person exercising their right to access their personal data. In all cases, the person requesting information must be provided with information on the identity and contact details of the controller of the data. Furthermore, the data subject must be informed of the personal data that has been processed and the purpose of the processing. He or she must also be informed of the period of time the data will be kept or, if this is not possible, the criteria for defining the period of time. The data subject must also be provided with the available information on the origin of the data (in cases where they have not provided the data themselves), and shall be informed in relevant cases of any automated individual decision-making, as well as of the logic on which the decision is based. Finally, the data subject must also be informed of the recipients or categories of recipients to whom the data may have been disclosed. If the recipients are located abroad, the information must specify the country concerned and, where appropriate, the guarantees of adequate protection that are provided or the application of one of the exceptions.
It is not necessary for a person to justify their request to the data controller when exercising their right to access their data, or to have their data corrected or destroyed. In principle, the information must be provided free of charge within 30 days. It should be noted that requests requiring a disproportionate effort may incur fees (up to a maximum of CHF 300).
In certain cases, the right to information may be refused, restricted or deferred, in particular if overriding private or public interests oppose it. In such a case, the data controller must indicate the reason that communication of the information is being refused, restricted or deferred. Any federal body refusing or granting only limited access must communicate a decision to you, and you have the right to appeal that decision. The reasoning given must enable the person concerned to check whether the restriction of their right to information is justified. The procedural implementation of data subjects' rights is strengthened because the FADP now provides for easier access to justice by waiving court fees in civil proceedings.
How to make a request
The FDPIC has created letter templates to assist you in submitting a request for information or to request that data be corrected or destroyed. You can adapt the template according to your needs.
For requests for information from cantonal and communal authorities, please contact the data protection officer of your canton.
The request for access and the communication of the requested information may be made electronically (e.g. by email or using a web form), provided that the data controller takes adequate measures to ensure that the data subject has been correctly identified, and to protect their data from any unauthorised access by third parties when communicating the information. You can also send a paper copy of your request for information or for personal data to be destroyed, enclosing a copy of an official document (identity card, driving licence, etc.). As a general rule, you are permitted to make any data illegible that is not essential for identification purposes (e.g. height, photo, identity document number). However, the name and date of birth should remain legible. Additional data may be necessary to identify a person (e.g. address) in certain circumstances. The data controller is permitted to use the data of the identity document for the sole purpose of identifying you.
If your request is urgent, or if you need to submit evidence, it is advisable to sign your request by hand and send it by registered mail, or to sign and send it using a similar electronic system. For non-urgent requests, you can also send a registered letter if you do not receive a reply within 30 days.
Last modification 06.03.2024