Data protection and AI governance in Switzerland

Bring your personal data and AI operations into Switzerland - on solid legal ground.

A boutique Swiss law firm helping international companies meet Swiss data protection requirements and govern their use of AI. Compliance, representation, and AI policy - handled directly by an IAPP-certified privacy lawyer.

  • Swiss data protection compliance, aligned with your GDPR framework
  • Swiss representation under Article 14 FADP
  • AI policies and governance designed for practical implementation across your organization

Trusted by international and local companies operating in Switzerland

IAPP Certified (CIPP/E·CIPM) WTR1000 Recommended INTA Member
01 - The challenge

GDPR compliance does not automatically mean compliance in Switzerland.

Companies often discover the differences only when a client asks about their Swiss representative, the Swiss authority gets in touch, or internal use of AI raises new questions around client data and governance.

i.

Switzerland has its own data protection framework.

The revised Federal Act on Data Protection has applied since 1 September 2023. It applies to personal data processing that has effects in Switzerland, including processing carried out abroad. It shares many principles with the GDPR, but its scope and certain compliance requirements differ.

ii.

Liability can extend to individuals.

Criminal fines under the FADP can reach CHF 250,000 and are imposed primarily on the natural person responsible for the offense. Compliance can therefore create personal exposure for those responsible, as well as risk for the business.

iii.

AI use creates new governance issues.

Employees may already be using AI tools to process contracts, client files, and personal data. In Switzerland, AI governance currently draws on data protection, sector-specific rules, and broader legal obligations rather than a direct equivalent of the EU AI Act.

02 - Find out in one minute

Do you need a Swiss data protection representative?

Article 14 FADP requires certain private controllers based abroad to appoint a representative in Switzerland when all applicable conditions are met. Answer four questions for a first indication of whether the requirement may apply to you.

Swiss representative check

Indicative only - not legal advice.

Question 1 of 4

Do you have your registered office or domicile outside Switzerland?

Article 14 applies to private controllers with their registered office or domicile abroad.

Question 2 of 4

Does the processing concern individuals in Switzerland and relate to offering them goods or services or monitoring their behavior?

The requirement concerns processing linked to offering goods or services to, or monitoring the behavior of, individuals in Switzerland.

Question 3 of 4

Is the processing carried out on a large scale and on a regular basis?

Both the scale and the regular nature of the processing are relevant. Processing limited to isolated instances would not normally meet these conditions.

Question 4 of 4

Does the processing pose a high risk to the personality rights of the individuals concerned?

The assessment depends on the nature and extent of the processing and the risks it creates for the individuals concerned.

Confirm whether Article 14 applies to you

This check provides a first indication based on the cumulative conditions of Article 14 FADP. It does not constitute legal advice or an assessment of your specific situation.

03 - Our service

A boutique service, end-to-end.

From initial assessment to implementation, we provide focused legal support tailored to your activities in Switzerland.

i

Swiss compliance

We assess your activities under Swiss data protection law and put the required compliance framework in place, building on your existing GDPR program where appropriate.

  • Gap analysis under the revised FADP
  • Privacy notices and internal policies
  • Subject access requests and data breach management
  • Data processing agreements and vendor reviews
ii

Swiss representative

We assess whether Article 14 FADP applies to your activities and, where required, act as your Swiss data protection representative.

  • Assessment of the Article 14 requirements
  • Appointment as your Swiss representative
  • Point of contact for the FDPIC and individuals
  • Maintenance of your record of processing activities
iii

AI governance

We advise on the legal and governance issues arising from your use of AI, from internal tools and shadow AI to customer-facing systems and business use cases.

  • AI policies defining permitted and restricted uses
  • Review of AI tools, use cases, and legal risks
  • Governance framework for roles, approvals, and oversight
  • Contractual, data protection, IP, and transparency requirements
Anca Draganescu-Pinawin, founder of Araucaria
04 - The lawyer

All legal work is handled by Anca Draganescu Pinawin.

Founder of Araucaria, Anca advises on data protection, intellectual property, and related digital and AI matters. She holds the IAPP CIPP/E and CIPM certifications and is recommended in the WTR 1000 for trademarks in Switzerland. Before founding Araucaria, she was Senior IP Counsel at Novagraaf, part of the Questel Group.

She teaches intellectual property, data protection, internet law, and AI law at CREA (Omnes Education Group) and regularly delivers professional training and corporate workshops. Her work has been published in WIPO Magazine, The Licensing Journal, The Fashion Law, and other publications.

Clients work directly with Anca throughout their matters, with no layers of junior lawyers or account management.

Doing business is a bit like gambling. We help you keep the gambling to a minimum.
05 - How it works

A clear path from first call to working framework.

30 minutes · Complimentary

Discovery call

We discuss your activities in Switzerland, the personal data you process, and how AI is currently used across your organization, and identify the key legal and governance issues.

Within 3 working days

Bespoke proposal

You receive a clear roadmap setting out the legal requirements, proposed scope of work, timeline, and fixed fees.

Ongoing

Implementation & support

We prepare the necessary documents, act as your Swiss representative where required, and remain available as your data protection and AI governance needs evolve.

Get in touch

Talk to a Swiss privacy lawyer.

Tell us about your activities in Switzerland and how your organization uses AI. We will reply within 72 hours with an initial assessment of the issues that may require attention.

  • araucaria point sàrl
  • Rue de l'Arquebuse 22, 1204 Geneva
  • start@araucaria.legal

Schedule a call

Thank you. Your message has been received. Anca will get back to you within 72 hours.
This form is for client enquiries.
For internships, theses or career questions, please write directly to start@araucaria.legal with "Career" in the subject line. Thank you for your interest.

Your information remains strictly confidential and is processed in accordance with applicable data protection requirements.

Schedule a call - 30 min, no obligation