International Data Transfer Addendum Template for Switzerland

When you transfer personal data from Switzerland to other countries, you need an International Data Transfer Addendum to ensure compliance with Swiss data protection laws. This legal document supplements your existing contracts and establishes the necessary safeguards for cross-border data transfers, particularly when sending data to jurisdictions that Switzerland has not recognized as providing adequate data protection.

When do you need this document?

You require this addendum whenever your Swiss organization transfers personal data internationally. This includes engaging cloud service providers based outside Switzerland, outsourcing customer service operations to foreign companies, or sharing employee data with overseas subsidiaries. The document becomes particularly critical when transferring data to countries without adequacy decisions from Swiss authorities, such as the United States, India, or most Asian and Latin American jurisdictions. Even transfers within multinational corporations require this protection when crossing Swiss borders.

Key legal considerations

Your addendum must address several critical legal elements to ensure enforceability and compliance. Data processing purposes must be clearly defined and limited to what you originally collected the data for under Swiss law. You need explicit provisions covering data subject rights, including access, rectification, erasure, and data portability rights that Swiss individuals retain even after international transfer. Security measures must meet Swiss standards, including encryption requirements, access controls, and regular security assessments. The document should establish clear breach notification procedures, requiring the data importer to notify you within 72 hours of any security incidents. Additionally, you must include audit rights, allowing you or third-party auditors to verify the data importer's compliance with the agreed safeguards.

Legal requirements in Switzerland

Under the Swiss Federal Data Protection Act (FADP) that took effect in September 2023, international data transfers require adequate protection levels or appropriate safeguards. Your addendum must demonstrate these safeguards through contractual clauses that mirror Swiss data protection standards. The Swiss Federal Data Protection and Information Commissioner (FDPIC) requires that you conduct transfer impact assessments for high-risk destinations, documenting why the transfer is necessary and how you will maintain data protection. You must also ensure the data importer can comply with Swiss law requirements, including responding to data subject requests and cooperating with Swiss authorities. The addendum should reference both the Swiss FADP and the Federal Data Protection Ordinance (FDPO), establishing jurisdiction clauses that allow Swiss courts to hear disputes and Swiss law to govern the agreement.