nFADP (Swiss Federal Act on Data Protection)

The nFADP (new Federal Act on Data Protection, in German revDSG or nDSG) is Switzerland's data protection law. The revised act entered into force on 1 September 2023, replacing the earlier Federal Act on Data Protection of 1992 and bringing Swiss law closer to the EU GDPR.

What it covers, in general terms

The nFADP governs how private companies and federal bodies process personal data about natural persons. Broadly, it:

• requires personal data to be processed lawfully, in good faith, proportionately and for purposes that are recognisable to the person concerned
• gives people rights, such as the right to be informed and to access data held about them
• treats some categories, including health data, as sensitive personal data that deserve extra care
• sets rules for disclosing personal data abroad, depending on whether the destination country offers adequate protection
• expects privacy by design and by default, and records of processing activities for many organisations

It is supervised by the Federal Data Protection and Information Commissioner (FDPIC). This is a general overview, not legal advice: check the official text and your own counsel for your situation.

nFADP and Laya Studio

Laya Studio is designed to support compliance with the nFADP and the EU GDPR: inference runs on GPUs in Switzerland, an optional Swiss-only mode keeps every request in the country, request content is never stored, and account data sits in Zurich. A Data Processing Agreement is available on request (privacy@laya.studio). You remain responsible for your own legal basis to process personal and health data, and Laya Studio holds no formal certification (such as ISO 27001) today. Read more on the Swiss data residency page, and see data residency and zero data retention.