Switzerland software delivery: the revised FADP, QR-bill, TWINT and the federal e-ID

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Swiss law actually requires from what Netbase can evidence about its own practice, with regulator and government sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

• Who enforces data protection for a Switzerland-facing product?
• What can Netbase evidence for a Switzerland brief?
• Which requirement sits with which decision owner?
• Which steps come before a Switzerland-facing launch?
• Worked scenario: a Swiss shopper pays with TWINT
• What has Netbase built that is relevant to a Switzerland brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

Who enforces data protection for a Switzerland-facing product?

Switzerland is outside the European Union, so GDPR does not apply there directly. Since 1 September 2023 the revised Federal Act on Data Protection (FADP) has governed processing of personal data in Switzerland, replacing the Federal Act of 19 June 1992. The Federal Data Protection and Information Commissioner (FDPIC) is the federal authority that supervises compliance. Under Article 24, a controller must notify the FDPIC as quickly as possible of any data security breach that is likely to lead to a high risk to the data subject's personality or fundamental rights.

The FADP sets its own rule for sending personal data outside Switzerland, separate from the EU's own transfer regime. Article 16 lets a transfer go ahead without extra safeguards where the Federal Council has judged the destination adequate; the states, territories and international bodies it has judged adequate are listed in Annex 1 of the Data Protection Ordinance. Outside that list, a Switzerland-facing system needs its own safeguard: data protection clauses in the contract, notified to the FDPIC before the data is disclosed, which a data processing agreement can carry; standard data protection clauses the FDPIC has approved, issued or recognised beforehand; binding corporate rules approved in advance; or an agreement under international law such as Convention 108+. Article 17 keeps a narrow set of exceptions beyond those routes.

What can Netbase evidence for a Switzerland brief?

Procurement, security and data protection reviewers tend to ask for the same statements. These are the ones Netbase can give.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. Your advisers assess the Switzerland-facing processing against the revised FADP and the Article 16 disclosure rule above.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement written for the Switzerland-facing system sits on top of this baseline.
• Markets and hours. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Netbase has worked with clients in 80 countries. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days. In Zurich that working day falls at 3:00-12:15 during the Swiss winter and 4:00-13:15 during the Swiss summer.

Which requirement sits with which decision owner?

A Swiss brief spans several owners inside the buying organisation, and a proposal that conflates them is the fastest way to miss one once the contract is signed.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Swiss shopper pays with TWINT

A subscription retailer launches a Swiss storefront where shoppers pay with TWINT alongside cards, and invoices carry a QR-bill.

A proposal that cannot describe step 3, specifically what the checkout does when a TWINT payment does not confirm in time, has not yet scoped Swiss payments for this product.

What has Netbase built that is relevant to a Switzerland brief?

Netbase has delivered product personalisation on client print stores, including online designers and configurators for catalogue covers and custom bags, for print-commerce clients in Singapore, Switzerland, Hong Kong, Germany, China, the United Kingdom, the Netherlands, the United States, Poland, France and Portugal. The published record closest to this guide includes order-flow customisations for a German invitation-card printer, covering hidden design buttons on the cart page, a quantity dropdown, and the product key and ordered quantity written into the print PDF file name. The online designer feature builds record covers that engagement and five other print businesses, and the product personalisation and online design solution scopes configurator work of this kind.

Which questions should you ask a supplier?

• Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
• Which safeguard backs each cross-border data flow? Ask for the Annex 1 list entry or the approved clause, not just a claim that a safeguard exists.
• How does checkout handle TWINT alongside cards, and what happens when a payment does not confirm in time? A vague answer usually means the path has not been tested.
• Does our product need to accept the federal e-ID, and who holds that integration? This usually stays with the buyer, with the supplier building inside the access granted.
• Who owns German, French and Italian copy, and how does a change reach production? Translation drift across three languages is easiest to catch before launch, not after.
• How do you test against the federal accessibility standard? Ask for real assistive-technology testing, not a tool report alone.

What usually goes wrong?

• A Swiss brief is scoped as if GDPR applied directly. Signal: no one has named the FADP, the FDPIC or the Annex 1 adequacy list. Owner: the data protection officer.
• Disclosure abroad is decided after the hosting provider is already chosen. Signal: a cross-border flow with no documented safeguard. Owner: the data protection officer, scoping this at discovery.
• A checkout is built around cards first, with TWINT bolted on at the end. Signal: the payment flow needs a disruptive rework rather than an addition. Owner: the product owner, who should put both rails in the same discovery estimate.
• One language is translated and the other two assumed to follow. Signal: French or Italian screens and generated documents drift out of date after the first release. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on the revised Federal Act on Data Protection's own English text, the Federal Data Protection and Information Commissioner's own pages on cross-border transfer and the adequacy list, SIX Group's own description of the QR-bill standard, TWINT's own description of its payment service, the federal administration's own accessibility page, and the federal e-ID's own page on the 2025 referendum result and the e-ID itself, all checked on 2026-10-24, together with company statements and delivery evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Switzerland-facing brief; it does not decide which safeguard or language scope fits your organisation.

Plan the first release

Bring your FADP role split, your disclosure-abroad safeguard, your QR-bill and TWINT scope, and your German, French and Italian language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a European working day. The Germany guide covers works-council consultation and German e-invoicing formats for a neighbouring German-speaking market, the France guide covers CNIL guidance and the French e-invoicing reform, and the Netherlands guide covers Peppol e-invoicing and the Dutch supervisory authority, for buyers weighing other European markets alongside Switzerland.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Switzerland-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• Federal Act on Data Protection (FADP), English translation, status 1 September 2023
• Federal Data Protection and Information Commissioner (FDPIC), Cross-border transfer of personal data
• Federal Data Protection and Information Commissioner (FDPIC), Adequacy
• SIX Group, QR-bill
• TWINT
• Federal Office of Information Technology, Systems and Telecommunication, Accessibility in the federal administration
• Swiss e-ID, e-ID law approved at the ballot box