Table of content
A customer cannot unsubscribe from your newsletter, a competitor reports you, a file leaks: that is all it takes for an investigation to start. On that day, the FDPIC will not ask whether you "tried" to comply with the FADP. It will ask for documents.
In short
The FDPIC investigates on its own initiative or following a report, and you must hand over the documents it needs (Art. 49 FADP).
Refusing to cooperate can cost the responsible person a fine of up to CHF 250,000 (Art. 60).
Five documents make the difference: register, proof of consent, transfers, protection by default, contracts.
How an FDPIC investigation works
The FDPIC opens an investigation as soon as there are sufficient indications that processing breaches the law (Art. 49 FADP). If you do not cooperate, it can order access to documents and premises (Art. 50).
It does not impose fines: it orders you to modify, suspend or stop processing (Art. 51). Fines of up to CHF 250,000 are imposed by the cantonal criminal authorities on the responsible individuals, for intentional violations (Art. 60 to 66). The GDPR, by contrast, fines the company. More in our FADP and GDPR compliance guide.
Document 1: the record of processing activities
The typical question: "Show me that you control your data flows."
What to provide: an up-to-date record (Art. 12 FADP): purposes, data categories, recipients, retention period, security and destination countries.
Bad answer: "We use Google Analytics and Facebook, I think."
Good answer: every tool and every tag, with the data collected, purpose, retention period and hosting location.
Companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 24 of the Data Protection Ordinance). The record is still the fastest way to answer.
A-Track tip
An Excel file frozen since 2023 no longer reflects your site. Compare the record with your GTM container at least once a year.
Document 2: proof of consent
The typical question: "How do you prove that Mr Dupont accepted ad tracking on 12 January 2026 at 2:02 pm?"
What to provide: an extract from your CMP log: pseudonymous ID, date and time, version of the policy shown, categories accepted or refused.
In Switzerland, the FADP does not require consent as a general rule (for cookies, Art. 45c of the Telecommunications Act provides a right to refuse). But as soon as you rely on consent (EU visitors, personalised ads required by Google since 31 July 2024), you must be able to prove it. A plugin without a log leaves you with no proof.
Document 3: transfers abroad
The typical question: "On what basis do you send this data outside Switzerland?"
What to provide: for each tool, the country and the safeguard (Art. 16 FADP). Adequate country (EU): nothing more. United States: recipient certified under the Swiss-U.S. Data Privacy Framework (in force since 15 September 2024), otherwise standard clauses. Other countries (China for TikTok): standard clauses.
A data protection impact assessment is only mandatory for high-risk processing (Art. 22). Always document data minimisation: server-side tracking lets you truncate IP addresses, hash e-mails and filter sensitive data before sending.
Document 4: proof of protection by default
The typical question: "Are your tags blocked until the visitor has chosen?"
What to provide: a Google Tag Manager audit and a documented test (screenshots, Network tab). The FADP requires data protection by default (Art. 7). A Meta pixel firing before any click takes ten seconds to spot: for EU visitors, it is a clear violation; in Switzerland, it contradicts your own banner. It is the mistake we fix most often (see our Consent Mode v2 guide).
Document 5: data processing agreements
The typical question: "What guarantees do you have with your agency and your SaaS tools?"
What to provide: signed data processing agreements (DPA). Art. 9 FADP requires a contract and security guarantees; entrusting data without them is punishable (Art. 61). Also forbid your providers to reuse your data for their own purposes. For agencies, see FADP vs GDPR for web agencies.
Conclusion: a file of evidence, not a frozen state
These documents require legal (a data protection advisor, optional in Switzerland but valuable) and technical teams to work together.
Gather your record, contracts and an export of the CMP log.
Test your site by refusing everything: no advertising tag should fire.
Schedule a yearly review and one after every new tool.
Everything can be fixed and documented: act before the inspection.
Would your FADP evidence file hold up before the FDPIC?
A-Track checks your site the way an investigator would: tags before consent, CMP log, transfers abroad and documentation.
Get a free tracking and compliance audit, delivered within 48 hours, with the list of evidence to complete.