Skip to main content

​
Switzerland Revised FADP + UCA Sender Rules

Switzerland (CH) is not in the EU or the EEA, and it does not run on the GDPR. It has its own revised Federal Act on Data Protection (FADP), in force since 2023-09-01, and its own unfair-competition statute whose opt-in rule governs commercial email and SMS. For EU-domiciled tenants, +41 is also the most common adequacy destination outside the Union, so the Swiss row touches two regimes at once: Swiss law on the way in, and your GDPR transfer posture on the way out. This page expands the CH row of the country-requirements matrix so you can close the Swiss items deliberately. Switzerland is a tenant-owned burden. Orbit keeps the country-rules reference that feeds the send-time gates, and it gives you the consent ledger, suppression, and quiet-hours surfaces below. The legal posture for your +41 traffic is yours.
This page is documentation, not legal advice. The FADP is enforced by the Federal Data Protection and Information Commissioner (FDPIC) and the courts; the Unfair Competition Act (UCA, German: UWG, French: LCD) is enforced against the sender, with criminal sanctions on complaint and civil injunctions open to competitors and consumer bodies. Have counsel review your consent capture and STOP handling; Orbit supplies the surfaces.

​
Two regimes: the revised FADP and the UCA opt-in

The revised FADP (SR 235.1), in force 2023-09-01. The revision replaced the 1992 act and applies to any processing of personal data with effect in Switzerland, which includes storing or using +41 recipients’ numbers, consent records, and reply history. It carries its own duties of care, information obligations, a data-breach notification duty to the FDPIC (Art. 24), and a representative rule for foreign controllers (Art. 14) — see the DPO section below. The telecom-side counterpart is the Federal Office of Communications (OFCOM, German: BAKOM), whose numbering rules concern number assignment, not SMS sender registration. The UCA opt-in for commercial email and SMS (SR 241, Art. 3 para. 1 let. o). The unfair-competition statute makes it unlawful to send mass commercial electronic messages without the recipient’s prior consent. In practice this is an opt-in regime for marketing email and SMS, on the same footing as the EU ePrivacy model: consent must exist before dispatch, the sender must be identifiable, and a working opt-out must accompany the message. Intentional violation is sanctioned under Art. 23 UCA on complaint, and Arts. 9–10 open injunctive actions to competitors and consumer organisations, which is how the rule is most often felt in practice. Voice marketing sits beside it under the telecom rules’ consent expectations — treat +41 marketing calls as consent-first, the same posture the EU pages describe.

​
The live CH country-rules row

Read the CH row first, then this page:
Consolidated from the seeded CH row (see Country Compliance Requirements; the live response is authoritative): Registration levels change at the operator — always read the live registration field rather than relying on this snapshot.

​
Sender-ID posture: operator-level, no statutory register

Switzerland runs no statutory alphanumeric sender-ID register. The regulator (OFCOM/BAKOM) governs numbering, and alphanumeric acceptance into +41 is decided operator by operator at the network edge — the same operator-level posture the sender-ID decision tree assigns to register-light markets. Because the CH row reads registration: none, nothing in Orbit holds your +41 traffic on sender registration. Two postures still matter:

​
Marketing opt-in under UCA Art. 3 para. 1 let. o

The rule: no mass commercial email or SMS without prior consent; identifiable sender; a working opt-out with every message. Silence, pre-ticked boxes, and inferred consent do not count. An existing customer relationship narrows but does not remove the requirement — counsel should confirm whether your use case falls inside the exception before you rely on it. Tenant-owned controls that map to the UCA rule: The consent record shape. The record your capture writes — and the one a dispute will be argued over — carries:
  • Scope — the channel consented to (sms, email, voice); Swiss opt-in is purpose-bound, so a voice consent does not cover SMS.
  • Granted-at timestamp — the UTC instant the recipient affirmed, never backfilled.
  • Source — the form, keyword, or call flow the consent was captured on, with the disclosure text as presented.
  • Subject — the +41 number or email address the consent attaches to, matching the destination you send.
Consent Management stores and returns these fields; Consent Receipt Integrity describes how each sent message binds back to the record that authorised it, which is exactly the evidence an Art. 23 complaint or an Art. 9 injunction asks for.

​
Switzerland and the GDPR carve-out

Switzerland is non-EEA, so the GDPR does not apply directly to a Swiss-located sender, and the GDPR’s Swiss reach is carved to traffic that targets EU data subjects. The direction that matters for EU-domiciled tenants is the other one: personal data leaving the EU for Switzerland. The European Commission’s adequacy decision covers Switzerland, so EU-to-CH transfers under Chapter V GDPR do not need SCCs on top of the decision — the existing GDPR International Transfers page lists Switzerland among the adequacy destinations and carries the transfer posture your EU entity maintains. Treat that page as the export-side rulebook; this page is the Swiss-side rulebook. Inside Switzerland, the revised FADP runs its own export control: transfers out of Switzerland require an adequate destination or safeguards, mirroring the GDPR’s Chapter V shape from the other side. If your +41 contact data is processed outside Switzerland, your counsel will want the same SCC posture documented under the FADP, not only under the GDPR.

​
DPO and representative: how the FADP differs from GDPR

The revised FADP deliberately stops short of the GDPR’s accountability machinery: The practical posture for a non-Swiss tenant sending +41 traffic: if your processing has effect in Switzerland and you have no Swiss establishment, expect the Art. 14 representative question — designate a Swiss representative reachable by data subjects. Even where it does not trigger, appointing a data-protection adviser (the FADP’s voluntary role) is the recommended posture for tenants with material Swiss traffic, because it gives the FDPIC a named counterpart before a breach notification (Art. 24) or a subject access request arrives. Map the representative and adviser name into your DPO & Representative record and your Privacy Register so the two regimes’ named contacts live in one place.

​
Multilingual STOP family (DE/FR/IT)

A +41 recipient may reply in any of the three principal languages. The Opt-Out Keyword Alias Table already ships all three families, so a Swiss opt-out in any of them writes the same suppression entry: Swiss-German convention adds one nuance: Swiss consumers use the same written STOPP vocabulary as Germany for SMS opt-out (dialect is spoken, not written, in keyword replies), and recognition of bare STOP is high across all three language regions. Seed the three families and keep STOP; matching is locale-insensitive case-folding with Unicode normalisation, so arrêt and Arrêt. hit the same rule. When any of these fires, the suppression entry is channel-scoped to all — the recipient leaves SMS, WhatsApp, and RCS at once, the same maximally-permissive propagation the German page describes. If you serve Romansh-speaking recipients in Graubünden, add your own synonyms through the alias table’s add-a-row flow; no Romansh rows ship seeded.

​
Quiet hours in Switzerland

Swiss law sets no codified no-send window for marketing messages. The operating convention is the German-speaking one: no marketing calls or messages in the evening (from around 21:00), overnight, or on Sundays — Sunday observance is stronger in Swiss convention than in most European markets. Orbit’s surfaces for this: See Quiet-Hours FAQ for how the window resolves per recipient timezone.

​
CH launch checklist

Narrowed from the generic launch checklist in Country Compliance Requirements to the CH row:
1

Look up the CH row

Call GET /compliance/country-rules?country=CH and read the row’s sender_types, registration, content_restrictions, and stop_requirement.
2

Pick a sender type

Alphanumeric sender ID (operator-level acceptance) or a long code — both deliver into +41.
3

Register the sender if deliverability matters

Registration is none — the gate does not block CH on this. File through Sender-ID Registration for a stable brand identity across Swiss operators.
4

Capture UCA opt-in first

Record a consent entry with email or sms scope, granted-at timestamp, and source before any commercial send; consider Double-Opt-In for the evidence chain.
5

Wire the DE/FR/IT STOP families

Confirm the German, French, and Italian alias rows are live in your workspace’s Opt-out Rules and write suppression entries.
6

Set the Swiss quiet-hours window

Set tenant quiet hours over Europe/Zurich — 21:00–09:00 plus Sundays — to carry the convention the statute leaves open.
7

Check the transfer and representative side

EU-domiciled tenant: confirm Switzerland sits under the adequacy decision in GDPR International Transfers. Non-Swiss tenant with material +41 processing: take the Art. 14 representative and data-protection adviser questions to counsel and record the named contacts in DPO & Representative.
8

Launch

With CH enabled, consent captured, STOP families wired, and quiet hours set, start sending.