Swiss Data Protection Act: what psychologists and therapists must do

The revised Federal Act on Data Protection (FADP, often called the new FADP or nFADP) is the Swiss law that sets how any private person, including a psychologist or therapist in private practice, may collect, keep and share personal data. It has been in force since 1 September 2023. In a practice, it mainly affects the patient file, the software you use and where your data is hosted.

Who is concerned, and why patient data counts twice

The FADP applies to private persons, so it covers the independent psychologist, the psychotherapist in a group practice and the therapist who keeps session notes. According to the Federal SME portal, the act and its ordinances came into force on 1 September 2023.

Article 5 of the FADP lists data on health and the intimate sphere as sensitive personal data. Session notes, assessments and insurer reports usually contain this kind of data.

The FADP comes on top of professional secrecy; it does not replace it. Article 321 of the Swiss Criminal Code expressly names psychologists, physiotherapists, occupational therapists, dietitians and osteopaths, as well as their assistants. If your profession is not on that list, we suggest asking your association which secrecy rules apply to you.

You are the controller

The act defines the controller as the person who decides why and how data is processed (Art. 5 let. j). In your practice, that is you. The patient file software, the hosting provider, the email service or the AI tool that handle data for you are processors (Art. 5 let. k). The difference matters. If a patient asks for access to their data, you remain the one who must answer, even when the data sits with a provider (Art. 25 para. 4).

Principles to apply every day

Article 6 sets simple principles. Processing must be lawful, in good faith and proportionate. Data is collected for a purpose the patient can recognise, here the therapeutic follow-up. It must be accurate, and it is destroyed or anonymised once it is no longer needed.

Article 7 adds data protection by design and by default. You must ensure, through appropriate default settings, that processing is limited to the minimum needed for its purpose. Article 8 requires security suited to the risk. For health data, we suggest at least a strong password, two-factor authentication, a locked computer and encrypted backups.

Patient consent is not the topic of this page; it depends on the situation and is covered in a separate article on our French-language blog.

Informing your patients

Article 19 requires you to inform people when you collect their data. The patient must receive at least your identity and contact details, the purpose of the processing and, where relevant, who receives the data (insurer, referring doctor, providers). If data goes abroad, you must also give the country and, where relevant, the safeguards in place or the Article 17 exception applied.

We suggest a one-page privacy notice, handed over at the first appointment. We also suggest naming the types of tools you use (patient file software, hosting, note-taking tool) and the hosting country.

The register of processing activities: what the rule actually says

Article 12 of the FADP provides for a register of processing activities. It contains at least the controller's identity, the purpose, the categories of people and data, the recipients and, where possible, the retention period and the security measures.

The Data Protection Ordinance (DPO, Art. 24) exempts companies with fewer than 250 employees and natural persons, unless the processing involves sensitive data on a large scale or high-risk profiling. The ordinance does not define what large scale means here. A solo practice is therefore neither clearly required nor clearly exempt.

Our advice: keep a simple register, even a single page. It helps you list your tools and feeds your privacy notice.

Processors: software, hosting, AI tools

You may hand data to a provider, under clear conditions (Art. 9). There must be a contract or a legal basis. The provider may only do what you would be allowed to do yourself. No duty of secrecy may forbid it. You must make sure the provider is able to guarantee data security. Finally, it may only pass the work on to another provider (sub-processing) with your prior authorisation.

Before choosing a tool, we suggest checking these points:

• a data processing agreement (DPA) exists and you can read it;
• the country where data is stored and processed is clearly stated;
• the list of sub-processors is published, with a way to be told about changes;
• data is encrypted in transit and at rest;
• you can export and delete the data when the contract ends.

We compared the terms of ChatGPT, Gemini and Claude in our article on whether AI trains on therapy notes.

Data hosted abroad

The FADP allows data to be disclosed abroad if the Federal Council has found that the country offers an adequate level of protection (Art. 16 para. 1). The list is in Annex 1 of the DPO. France, Germany and the other European Union member states we checked are on it.

The United States is also in Annex 1, but only for organisations certified under the Swiss-U.S. Data Privacy Framework. According to the Federal Council's press release, this rule has applied since 15 September 2024. For a provider that is not certified, or a country not on the list, other safeguards are needed, such as standard contractual clauses recognised by the FDPIC (Art. 16 para. 2), or one of the exceptions in Article 17.

How long to keep the patient file

The FADP sets no period. It only says that data is destroyed or anonymised once it is no longer needed (Art. 6 para. 4). The retention period for patient files comes from cantonal health laws, which differ from one canton to another.

One example: the official website of the canton of Geneva cites Article 57 of the Geneva health act. File contents are kept as long as they are of interest for the patient's health, but at least ten years after the last consultation, and the file is destroyed after twenty years at the latest, unless an overriding interest says otherwise. Elsewhere, check your own canton's law.

Your patients' rights

Any patient may ask whether you process data about them (Art. 25). They then receive at least your identity and contact details, the data itself, the purpose, the retention period or the criteria for it, and the recipients. The information is free of charge, except in cases set by the Federal Council, and is usually provided within 30 days. Nobody can waive this right in advance.

Article 25 para. 3 provides a specific rule for health: health data may be given to the patient, with their consent, through a health professional they choose. Patients may also ask for inaccurate data to be corrected and, through court action, ask for processing to be stopped or their data to be erased (Art. 32).

On insurer reports, see our page on the Swiss insurer report after 30 psychotherapy sessions.

If a data breach happens

If the breach is likely to pose a high risk for the patient, you report it to the FDPIC as soon as possible (Art. 24). The FDPIC provides an online reporting portal (databreach.edoeb.admin.ch). Your processor, for its part, must report every breach to you. You inform the patient when this is needed to protect them or when the FDPIC asks. The ordinance requires you to document breaches and keep that documentation for at least two years (DPO, Art. 15 para. 4).

Fines: what they actually target

Article 61 provides for a fine of up to CHF 250,000. It is not automatic. It is imposed on complaint, against the private person who acted intentionally. It covers disclosure abroad without safeguards, using a processor outside the Article 9 conditions and failing minimum security requirements. According to the FDPIC guide, failing to report a breach is not in itself punishable under the FADP, but the FDPIC can order the controller to remedy it.

Checklist for your practice

• List every tool that touches patient data.
• For each one, get and read the data processing agreement, and note the hosting country.
• Check that each country is in Annex 1 of the DPO, or that other safeguards are in place.
• Write a one-page privacy notice for patients.
• Keep a simple register of your processing (recommended, even if you may be exempt).
• Turn on two-factor authentication and encrypt your backups.
• Know the retention period set by your canton.
• Prepare a template reply to access requests (usually within 30 days).
• Know how to report a breach to the FDPIC and log every incident.

What about a tool like Delta?

Delta is the clinical assistant for mental health and allied health professionals. Data is hosted in France, a country listed as adequate in Annex 1 of the DPO, with an HDS-certified hosting provider, and AI processing takes place in France. The patient's name and identifying details are pseudonymised before the AI step. No audio file is kept. Data is never used to train a model and is encrypted in transit and at rest. Delta also drafts letters, certificates and assessments, adapted to the profession (see our document templates).

These facts do not replace your own obligations. Whatever the tool, Delta included, we suggest reading its data processing agreement and its list of sub-processors before you put any patient data into it.

Frequently asked questions

Sources

• Federal Act on Data Protection (FADP), SR 235.1 and Data Protection Ordinance (DPO), SR 235.11, Fedlex (French text), accessed 16 October 2026.
• Federal SME portal: new Data Protection Act (in French).
• FDPIC: guide on reporting data security breaches (Art. 24 FADP), version of 23 April 2025 (in French).
• Federal Council: press release of 14 August 2024 on the Swiss-U.S. Data Privacy Framework (in French).
• Canton of Geneva: rules for therapists (file retention, Art. 57 of the health act, in French).