> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Switzerland Revised FADP + UCA Sender Rules > Switzerland's per-country posture expanded from the country-requirements matrix: the revised FADP (in force 2023-09-01) beside the Unfair Competition Act opt-in for commercial email and SMS, the operator-level sender-ID posture, the DE/FR/IT STOP family, adequacy-based transfers, and the tenant quiet-hours setup for +41 traffic. # Switzerland Revised FADP + UCA Sender Rules Switzerland (`CH`) is not in the EU or the EEA, and it does not run on the GDPR. It has its own revised Federal Act on Data Protection (FADP), in force since 2023-09-01, and its own unfair-competition statute whose opt-in rule governs commercial email and SMS. For EU-domiciled tenants, +41 is also the most common adequacy destination outside the Union, so the Swiss row touches two regimes at once: Swiss law on the way in, and your GDPR transfer posture on the way out. This page expands the CH row of the [country-requirements matrix](/compliance/country-requirements) so you can close the Swiss items deliberately. Switzerland is a **tenant-owned burden**. Orbit keeps the [country-rules reference](/compliance/country-requirements) that feeds the send-time gates, and it gives you the consent ledger, suppression, and quiet-hours surfaces below. The legal posture for your +41 traffic is yours. This page is documentation, not legal advice. The FADP is enforced by the Federal Data Protection and Information Commissioner (FDPIC) and the courts; the Unfair Competition Act (UCA, German: UWG, French: LCD) is enforced against the sender, with criminal sanctions on complaint and civil injunctions open to competitors and consumer bodies. Have counsel review your consent capture and STOP handling; Orbit supplies the surfaces. *** ## Two regimes: the revised FADP and the UCA opt-in **The revised FADP (SR 235.1), in force 2023-09-01.** The revision replaced the 1992 act and applies to any processing of personal data with effect in Switzerland, which includes storing or using +41 recipients' numbers, consent records, and reply history. It carries its own duties of care, information obligations, a data-breach notification duty to the FDPIC (Art. 24), and a representative rule for foreign controllers (Art. 14) — see the DPO section below. The telecom-side counterpart is the Federal Office of Communications (OFCOM, German: BAKOM), whose numbering rules concern number assignment, not SMS sender registration. **The UCA opt-in for commercial email and SMS (SR 241, Art. 3 para. 1 let. o).** The unfair-competition statute makes it unlawful to send mass commercial electronic messages without the recipient's prior consent. In practice this is an opt-in regime for marketing email and SMS, on the same footing as the EU ePrivacy model: consent must exist before dispatch, the sender must be identifiable, and a working opt-out must accompany the message. Intentional violation is sanctioned under Art. 23 UCA on complaint, and Arts. 9–10 open injunctive actions to competitors and consumer organisations, which is how the rule is most often felt in practice. Voice marketing sits beside it under the telecom rules' consent expectations — treat +41 marketing calls as consent-first, the same posture the EU pages describe. *** ## The live CH country-rules row Read the CH row first, then this page: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&country=CH" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` Consolidated from the seeded CH row (see [Country Compliance Requirements](/compliance/country-requirements); the live response is authoritative): | Rule | CH value | What it means for you | | - | - | - | | Sender types | `alphanumeric`, `long_code` | Both accepted into +41. Alphanumeric delivery is operator-level: Swiss operators accept alphanumeric sender IDs at their own edge, with no statutory register above them. | | Registration | `none` (dynamic) | The send-time gate does not hold CH traffic on a missing registration. There is no OFCOM/BAKOM sender-ID register to file with; see the sender-ID section. | | Marketing consent | UCA Art. 3 para. 1 let. o — opt-in | Commercial email and SMS to +41 require prior consent. Record it in the consent ledger before dispatch; see the opt-in section. | | No-send windows | No statutory window | Swiss law sets no codified SMS quiet hours. The convention tracks the German-speaking norm — no marketing in the evening, overnight, or on Sundays — and is yours to enforce with tenant quiet hours. | | Opt-out keyword | Multilingual STOP family | +41 recipients may reply in German, French, or Italian. Wire all three families; see the keyword section. | Registration levels change at the operator — always read the live `registration` field rather than relying on this snapshot. *** ## Sender-ID posture: operator-level, no statutory register Switzerland runs no statutory alphanumeric sender-ID register. The regulator (OFCOM/BAKOM) governs numbering, and alphanumeric acceptance into +41 is decided operator by operator at the network edge — the same operator-level posture the [sender-ID decision tree](/compliance/sender-id-by-market-decision-tree) assigns to register-light markets. Because the CH row reads `registration: none`, nothing in Orbit holds your +41 traffic on sender registration. Two postures still matter: | Posture | Orbit surface | | - | - | | Stable alphanumeric identity | File the sender through [Sender-ID Registration](/compliance/sender-id-registration) anyway if deliverability matters — operator-level acceptance is route-specific, and a registered sender is the difference between your brand and a relabelled long code on some Swiss routes. | | Identifiable sender | The UCA requires the commercial sender to be identifiable. Keep the sender name consistent with your brand identity and your message footer. | *** ## Marketing opt-in under UCA Art. 3 para. 1 let. o **The rule:** no mass commercial email or SMS without prior consent; identifiable sender; a working opt-out with every message. Silence, pre-ticked boxes, and inferred consent do not count. An existing customer relationship narrows but does not remove the requirement — counsel should confirm whether your use case falls inside the exception before you rely on it. **Tenant-owned controls that map to the UCA rule:** | UCA obligation | Orbit surface | | - | - | | Prior consent before commercial send | [Consent Management](/compliance/consent-management) — a consent record with `email` or `sms` scope captured before dispatch. | | Proof the consent is real | [Double-Opt-In](/compliance/double-opt-in) — the confirmation step that turns a claimed opt-in into an evidence chain, the same posture the German and Austrian pages recommend. | | Identifiable sender + working opt-out | [Email List-Unsubscribe Posture](/compliance/email-list-unsubscribe-posture) for email; the STOP family below for SMS. | | Ledger retention for disputes | [Archival Export](/compliance/archival-export) — export the consent ledger with timestamps and prompt history when a complaint or an Art. 9 UCA injunction lands. | **The consent record shape.** The record your capture writes — and the one a dispute will be argued over — carries: * **Scope** — the channel consented to (`sms`, `email`, `voice`); Swiss opt-in is purpose-bound, so a voice consent does not cover SMS. * **Granted-at timestamp** — the UTC instant the recipient affirmed, never backfilled. * **Source** — the form, keyword, or call flow the consent was captured on, with the disclosure text as presented. * **Subject** — the +41 number or email address the consent attaches to, matching the destination you send. [Consent Management](/compliance/consent-management) stores and returns these fields; [Consent Receipt Integrity](/compliance/consent-receipt-integrity) describes how each sent message binds back to the record that authorised it, which is exactly the evidence an Art. 23 complaint or an Art. 9 injunction asks for. *** ## Switzerland and the GDPR carve-out Switzerland is non-EEA, so the GDPR does not apply directly to a Swiss-located sender, and the GDPR's Swiss reach is carved to traffic that targets EU data subjects. The direction that matters for EU-domiciled tenants is the other one: personal data leaving the EU for Switzerland. The European Commission's adequacy decision covers Switzerland, so EU-to-CH transfers under Chapter V GDPR do not need SCCs on top of the decision — the existing [GDPR International Transfers](/compliance/gdpr-international-transfers) page lists Switzerland among the adequacy destinations and carries the transfer posture your EU entity maintains. Treat that page as the export-side rulebook; this page is the Swiss-side rulebook. Inside Switzerland, the revised FADP runs its own export control: transfers out of Switzerland require an adequate destination or safeguards, mirroring the GDPR's Chapter V shape from the other side. If your +41 contact data is processed outside Switzerland, your counsel will want the same SCC posture documented under the FADP, not only under the GDPR. *** ## DPO and representative: how the FADP differs from GDPR The revised FADP deliberately stops short of the GDPR's accountability machinery: | Question | GDPR | Revised FADP | | - | - | - | | Mandatory DPO? | Yes, where Art. 37 triggers apply | No — the FADP has no mandatory DPO | | Representative for foreign controllers | Art. 27 representative in the EU | Art. 14 representative in Switzerland when processing has effect there and no Swiss establishment exists | | Voluntary in-country adviser | No direct analogue | The act provides for a voluntarily designated data-protection adviser, whose appointment shifts certain FDPIC information dynamics | The practical posture for a non-Swiss tenant sending +41 traffic: if your processing has effect in Switzerland and you have no Swiss establishment, expect the Art. 14 representative question — designate a Swiss representative reachable by data subjects. Even where it does not trigger, appointing a data-protection adviser (the FADP's voluntary role) is the recommended posture for tenants with material Swiss traffic, because it gives the FDPIC a named counterpart before a breach notification (Art. 24) or a subject access request arrives. Map the representative and adviser name into your [DPO & Representative](/compliance/dpo-representative) record and your [Privacy Register](/compliance/privacy-register) so the two regimes' named contacts live in one place. *** ## Multilingual STOP family (DE/FR/IT) A +41 recipient may reply in any of the three principal languages. The [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) already ships all three families, so a Swiss opt-out in any of them writes the same suppression entry: | Language | Seeded opt-out aliases | | - | - | | German | `STOPP`, `ABBESTELLEN`, `ABMELDEN`, `ENDE`, `ABBRECHEN` | | French | `ARRÊT`, `ARRET`, `ANNULER`, `STOP`, `FIN` | | Italian | `FERMA`, `CANCELLA`, `FINE`, `ANNULLA` | Swiss-German convention adds one nuance: Swiss consumers use the same written STOPP vocabulary as Germany for SMS opt-out (dialect is spoken, not written, in keyword replies), and recognition of bare `STOP` is high across all three language regions. Seed the three families and keep `STOP`; matching is locale-insensitive case-folding with Unicode normalisation, so `arrêt` and `Arrêt.` hit the same rule. When any of these fires, the suppression entry is channel-scoped to `all` — the recipient leaves SMS, WhatsApp, and RCS at once, the same maximally-permissive propagation the German page describes. If you serve Romansh-speaking recipients in Graubünden, add your own synonyms through the alias table's add-a-row flow; no Romansh rows ship seeded. *** ## Quiet hours in Switzerland Swiss law sets no codified no-send window for marketing messages. The operating convention is the German-speaking one: no marketing calls or messages in the evening (from around 21:00), overnight, or on Sundays — Sunday observance is stronger in Swiss convention than in most European markets. Orbit's surfaces for this: | Surface | Behaviour for CH | | - | - | | Tenant quiet hours (deliberate) | [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — tenant-owned control, default **OFF / fail-open**. Set a Europe/Zurich window of 21:00–09:00 plus Sundays if you want the platform to hold CH marketing sends. Nothing in Orbit defaults this on. | | Platform default (fallback) | With no tenant window set, drip and journey sends inherit the platform default 21:00–09:00 recipient local, which covers the evening side of the Swiss convention; the Sunday side is yours to add as tenant quiet hours. | See [Quiet-Hours FAQ](/compliance/quiet-hours-faq) for how the window resolves per recipient timezone. *** ## CH launch checklist Narrowed from the generic launch checklist in [Country Compliance Requirements](/compliance/country-requirements) to the CH row: Call `GET /compliance/country-rules?country=CH` and read the row's `sender_types`, `registration`, `content_restrictions`, and `stop_requirement`. Alphanumeric sender ID (operator-level acceptance) or a long code — both deliver into +41. Registration is `none` — the gate does not block CH on this. File through [Sender-ID Registration](/compliance/sender-id-registration) for a stable brand identity across Swiss operators. Record a consent entry with `email` or `sms` scope, granted-at timestamp, and source before any commercial send; consider [Double-Opt-In](/compliance/double-opt-in) for the evidence chain. Confirm the German, French, and Italian alias rows are live in your workspace's Opt-out Rules and write suppression entries. Set tenant quiet hours over Europe/Zurich — 21:00–09:00 plus Sundays — to carry the convention the statute leaves open. EU-domiciled tenant: confirm Switzerland sits under the adequacy decision in [GDPR International Transfers](/compliance/gdpr-international-transfers). Non-Swiss tenant with material +41 processing: take the Art. 14 representative and data-protection adviser questions to counsel and record the named contacts in [DPO & Representative](/compliance/dpo-representative). With CH enabled, consent captured, STOP families wired, and quiet hours set, start sending. *** ## Related references * [Country Compliance Requirements](/compliance/country-requirements) — the full matrix this page expands one row of. * [Regional Posture Hub](/compliance/country-rules-directory) — the index this page is listed under. * [GDPR International Transfers](/compliance/gdpr-international-transfers) — the EU-side adequacy posture for EU-to-CH transfers. * [Germany UWG + BNetzA](/compliance/germany-uwg-bnetza) — the German-speaking sibling regime the Swiss convention tracks. * [Austria TKG 2021 + RTR/DSB Sender Rules](/compliance/austria-tkg-rtr-dsb-sender-rules) — the second DACH sibling. * [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — the seeded STOPP / ARRÊT / FERMA families and the add-a-row flow. * [Consent Management](/compliance/consent-management) — where the UCA opt-in record lives. * [DPO & Representative](/compliance/dpo-representative) — the FADP representative and adviser record beside the GDPR's Art. 27. * [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — the tenant-owned control that carries the Swiss convention. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.