Swiss FADP Article 21 and automated individual decisions

What it is

The revised Federal Act on Data Protection (FADP), SR 235.1, is Switzerland’s data protection law. Parliament adopted it on 25 September 2020 and it came into force on 1 September 2023, replacing the 1992 Act. Article 21 is its rule on automated individual decisions, and it is the main binding rule in Swiss law aimed at decisions made by algorithms, including AI systems, about people.

Switzerland has no AI-specific law. The Federal Data Protection and Information Commissioner (FDPIC) has said the FADP is drafted to be technology neutral and is directly applicable to AI-supported data processing. That makes Article 21, and the rest of the FADP, the core of AI governance for most Swiss organisations today.

Who it applies to

The FADP applies to private persons and federal bodies that process personal data of natural persons. Article 3 extends it to circumstances that have an effect in Switzerland even if they were initiated abroad, so a foreign organisation making automated decisions about people in Switzerland can be caught.

The duties in Article 21 fall on the controller, the private person or federal body that decides the purpose and means of the processing. An organisation that uses a vendor’s AI system to screen applicants, price insurance or approve credit remains the controller for those decisions. The vendor is usually a processor acting on its behalf.

What it requires

Article 21 is engaged when a decision is based exclusively on automated processing and has a legal consequence for the person or significantly adversely affects them. A decision where a person genuinely assesses the case before it takes effect is not caught, but a person who only confirms what the system recommends does not change its automated character.

Duty to inform. The controller must inform the person of an automated individual decision.

Right to be heard and to human review. On request, the controller must give the person the opportunity to express their point of view. The person may request that the decision be reviewed by a natural person.

Exceptions. These duties do not apply where the decision is directly connected with concluding or performing a contract between the controller and the person and their request is granted, or where the person has expressly consented to the decision being automated.

Federal bodies. A federal body must label an automated individual decision as such. The right to be heard does not apply where federal law gives the person no right to a hearing before the decision.

The rest of the FADP applies alongside Article 21. The right of access lets a person ask whether an automated individual decision was made and the logic on which it was based. Article 22 requires a data protection impact assessment where processing is likely to lead to a high risk to the person’s personality or fundamental rights, which the FDPIC says is required for high-risk AI processing. The FDPIC has also said that people have a right to know whether they are dealing with a machine, that deepfakes of identifiable people must be clearly indicated, and that applications such as comprehensive real-time facial recognition and social scoring undermine informational self-determination and are not permitted.

For an AI system, that turns into practical questions. Which systems decide things about people with real consequences, and is a person genuinely involved? How are people told? Who handles a request for human review, with the authority to change the outcome? And can the organisation explain the logic of the system to the person who asks?

Key dates

• 25 September 2020. Revised FADP adopted by the Federal Assembly.
• 1 September 2023. Revised FADP, including Article 21, in force.
• 9 November 2023. FDPIC states that current data protection law is directly applicable to AI.
• 12 February 2025. Federal Council decides Switzerland will ratify the Council of Europe AI Convention and amend Swiss law where needed.
• 27 March 2025. Switzerland signs the Council of Europe AI Convention.

How it relates to other frameworks

Article 21 takes a different route from GDPR Article 22. The GDPR gives a right not to be subject to solely automated decisions with significant effects, subject to exceptions. The FADP permits them and gives the person a right to be told, to be heard and to ask for a human to look again. Swiss organisations that also make decisions about people in the EU have to meet the stricter EU rule there.

The Federal Council has said Swiss law will be amended to ratify the Council of Europe AI Convention, with a consultation draft from the Federal Department of Justice and Police due by the end of 2026 covering transparency, data protection, non-discrimination and supervision. Financial institutions supervised by FINMA also follow FINMA Guidance 08/2024. Many Swiss organisations pair the FADP with ISO/IEC 42001 to structure their AI governance.

A note on this page

This is Aicura’s reading of FADP Article 21. It is not legal advice and it is not the Act itself. Read the official text on Fedlex, and take advice on how the FADP applies to your organisation.