As of 11 November 2026
Following a cyberattack, companies must act quickly: secure their systems, investigate the incident and limit possible damage. At the same time, they need to determine which authorities must be informed. For Swiss companies, the answer may extend beyond the Federal Data Protection and Information Commissioner, or FDPIC.
The notification thresholds differ. Under the Swiss Federal Act on Data Protection, the controller must notify the FDPIC of a data security breach as soon as possible if it is likely to result in a high risk to the personality or fundamental rights of those affected. The FDPIC's guidance explains the details.[1]
The threshold under the European General Data Protection Regulation, or GDPR, is lower: notification may be omitted if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is required, it must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. An assessment that there is «no high risk» is therefore insufficient. Article 33 GDPR governs this requirement.[2]
This article focuses on notifications to data protection authorities in the EU/EEA. Connections to other countries and sector-specific rules require additional assessment.
Check the scope of application first
The strongest argument against notification abroad often arises before the risk assessment: does the GDPR apply to the particular processing affected?
A Swiss company may be covered, in particular, where the processing takes place in the context of an establishment in the EU. Without such an establishment, the main question is whether the company targets people in the EU with goods or services, or monitors their behaviour there. The FDPIC also describes this extraterritorial effect.[3]
An affected person's European citizenship is not enough. Nor does a website's accessibility from Germany, by itself, bring the processing within scope. What matters is the actual activity and its connection to the European market.
Consider this example: a business operating exclusively locally in Aargau loses personnel data concerning employees who live and work in Switzerland. The fact that some employees hold German passports does not, by itself, trigger a GDPR notification obligation. Other connecting factors, particularly a relevant EU establishment, must still be assessed separately.
It is also important to assess each processing activity individually: an online shop targeting the EU does not automatically bring all unrelated internal processing by the same company within the GDPR. This distinction follows from the EDPB's guidelines on territorial scope.[4]
In practice, a specific mapping exercise is therefore useful: which systems and data are affected, which business activity do they serve, and what is that activity's European connection? A general statement that «we also have customers in Europe» cannot replace this assessment.
Four reasons why notification to an authority may be unnecessary
1. The affected processing falls outside the GDPR.
Where the required territorial and material connection is absent, there is no corresponding notification obligation under Article 33 GDPR. This may justify not notifying European data protection authorities even if Swiss law requires the incident to be reported to the FDPIC. The two legal regimes must be assessed separately.
2. There is no personal data breach.
An attempted attack that is repelled without compromising personal data is not, by itself, a notifiable personal data breach. The same applies to an incident involving only information that is not personal data.
Conversely, proven data theft is not a necessary condition: the destruction, alteration or loss of personal data can also constitute a breach. «We have not detected any data exfiltration» therefore answers only part of the question. The Berlin data protection authority explains the different forms a breach may take.[5]
3. A risk to affected individuals is unlikely.
Even where the GDPR applies and a personal data breach has been established, notification may be unnecessary. This requires a reasoned assessment of the possible consequences for the people whose data is affected.
One example is the loss of a device that was switched off and effectively encrypted. If the keys remain secure and the data remains available through functioning backups, a decision not to notify may be justified. What matters is the protection actually provided: a login password alone, or a general statement that «our devices are encrypted», is not a sufficient explanation. The EDPB's guidelines with practical examples discuss comparable situations.[6]
The assessment should consider, in particular, the sensitivity of the data, its usefulness to third parties and possible personal or economic disadvantages. The number of people affected is a factor, but it does not create an automatic de minimis exception.
A lack of information should not be confused with an absence of risk. If the investigation is incomplete, an initial notification followed by supplementary information may be required. The Bavarian data protection authority expressly provides for such a process.[7]
4. The company acts solely as a processor.
A Swiss service provider processing the affected data solely on behalf of a controller must inform that controller without undue delay under Article 33(2) GDPR. Notification to the authority under paragraph 1 is, in principle, the controller's responsibility. The service provider may therefore have no obligation to notify a foreign data protection authority itself. It can still make a notification on its client's behalf. Article 33 GDPR sets out this allocation of roles.[2]
This reasoning depends on identifying the roles correctly. If the same incident also affects data for which the service provider determines the purposes of processing itself, that part requires a separate assessment.
Multiple authorities: establish who has jurisdiction
For companies without a relevant establishment in the EU, the European notification system is particularly demanding. According to the EDPB guidelines, a notifiable breach must be reported to the competent supervisory authorities in the member states where affected individuals reside. A representative under Article 27 GDPR does not provide access to the so-called one-stop-shop with a lead supervisory authority. Paragraph 73 of Guidelines 9/2022 states this expressly.[8]
This does not mean that every European data protection authority must be notified indiscriminately. The affected countries and their competent authorities must first be identified. A careful assessment can significantly reduce the workload. It does not, however, automatically justify dispensing with all notifications abroad. Notifying the FDPIC does not replace the required European notifications either.
Which further counterarguments are persuasive?
The demand for parallel notifications can be questioned as a matter of regulatory policy. Providing several authorities with the same information creates costs, while the additional protection for affected individuals may appear limited in a particular case.
From a legal perspective, one could examine whether a particular interpretation of jurisdiction is consistent with the statutory wording, proportionality and legal certainty. Guidelines are not legislation. In my view, this may provide grounds to examine or challenge a specific assertion of multiple jurisdictions.
It does not, however, create a reliable general exemption from notification. Article 33 GDPR provides no exemption for high administrative costs. The disproportionate-effort exception in Article 34(3) concerns individual communication to affected persons and requires public communication or a similar measure instead. It cannot be applied to notifications to authorities.[2]
The Swiss prohibition on unauthorised activities on behalf of a foreign state does not offer a blanket solution either. The Federal Department of Justice and Police, or FDJP, expressly states that an ordinary notification containing the information required by Article 33(3) GDPR does not fall under this prohibition. In its view, no federal authorisation is required. In particular, the minimum content does not include a list of affected individuals' names. The FDJP explains this in its guidance on Article 271 of the Swiss Criminal Code and GDPR notifications.[9]
Further requests for information or evidence from a foreign authority may raise different issues. They should be assessed independently, rather than used to infer a general prohibition on the initial notification.
Finally, companies may consider the likelihood of a foreign sanction and its enforcement. That concerns the risk of breaching an obligation, however. It does not answer the prior question of whether the obligation exists. A company that refrains from notifying despite recognising an obligation is making a legal-risk decision and should describe it accordingly.
Simplifications are proposed but do not yet apply
The European reform debate addresses the burden of notification. Proposals under the Digital Omnibus include extending the notification deadline to 96 hours and limiting notification to authorities to breaches likely to result in a high risk. The EDPB and the European Data Protection Supervisor support these changes in their joint opinion of February 2026.[10]
The Council adopted its negotiating position on 21 October 2026. It supports a longer notification deadline and envisages national entry points for reports under different EU rules. This is the Council's negotiating position, not yet an applicable new regime.[11]
As of 11 November 2026, the legislative procedure remains open. Companies must therefore not apply the proposed higher notification threshold or the 96-hour deadline in advance.[12]
A decision not to notify needs sound reasons
A useful decision record sets out:
- which data and processing activities are affected;
- why the GDPR applies or does not apply;
- the company's role;
- the possible consequences for individuals and which safeguards actually work;
- why notification is made or omitted, and when new findings will trigger reassessment.
A justified decision not to notify does not remove other obligations. Alongside Swiss data protection law, for example, covered operators of critical infrastructure have been subject to separate reporting obligations to the National Cyber Security Centre since April 2025.[13]
A Swiss company can therefore reach a legally supported conclusion that it need not inform any European data protection authority. That conclusion must rest on an assessment of the particular incident: scope, allocation of roles and risk must support the decision. A Swiss registered office alone is not enough.