Limitations on the right to information

Article 26

The controller may refuse to provide information, or restrict or delay the provision of information if:
- a. a formal law so provides, in particular in order to preserve professional secrecy;
- b. this is required to safeguard overriding third-party interests; or
- c. the request for information is obviously unjustified, in particular if does not serve the purpose of data protection or is clearly frivolous.
Furthermore, it is possible to refuse, restrict or delay the provision of information in the following cases:
- a. The controller is a private person and the following requirements are satisfied:
  1. The controller's own overriding interests require the measure.
  2. The controller does not intend to disclose the personal data to third parties.
- b. The controller is a federal body, and one of the following requirements is satisfied:
  1. The measure is required to satisfy overriding public interests, in particular Switzerland's internal or external security.
  2. The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.
Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 2 letter a number 2.
The controller must indicate why it is refusing, restricting or delaying the provision of the information.

Take a Brighter Approach to Privacy, AI, and Digital Governance Compliance