Principles

Article 16

Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection.
In the absence of a decision by the Federal Council under paragraph 1, personal data may be disclosed abroad only if an appropriate level of data protection is guaranteed by:
- a. a treaty under international law;
- b. data protection clauses in an agreement between the controller or the processor and its contractual partner, notice of which has been given to the FDPIC beforehand;
- c. specific guarantees drawn up by the competent federal body, notice of which has been given to the FDPIC beforehand;
- d. standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; or
- e. binding corporate rules that have been approved in advance by the FDPIC or by the authority responsible for data protection in a State that guarantees an adequate level of protection.
The Federal Council may provide for other appropriate guarantees in line with paragraph 2.

Take a Brighter Approach to Privacy, AI, and Digital Governance Compliance