FDPIC notification duty and AI guidance: 72-hour rule under FADP Art. 24 and current recommendations 2024-2026

Who is the FDPIC?

The Federal Data Protection and Information Commissioner (FDPIC, German EDÖB) is the independent data protection supervisory authority in Switzerland. Since the revised FADP (1 Sep 2023), the FDPIC has markedly expanded powers: ex officio investigations, binding orders (blocking, deletion, adjustment of processing), free complaint procedures, public recommendations.

Seat and address: FDPIC, Feldeggweg 1, 3003 Bern. Phone +41 58 462 43 95, web www.edöb.admin.ch. The FDPIC regularly publishes opinions (Kurzmeldungen), guidance and annual reports. The 32nd Annual Report 2024/25 was published in June 2025.

In the AI context three FDPIC functions are practically relevant. First the notification duty under FADP Art. 24 – data security breaches with high risk for affected persons must be reported within 72 hours of awareness. Second consultation – the FDPIC offers free, non-binding initial consultations for processors with data protection questions. Third investigation and measures – the FDPIC may open ex officio investigations, order measures and publish recommendations after review.

Why the FDPIC notification duty directly affects AI setups

AI systems create new classes of data protection breaches for which classical IT security frameworks are not directly prepared.

First: prompt leakage. An employee inadvertently feeds client personal data into a public ChatGPT account without a DPA. Once the FDPIC becomes aware (internal report, audit, complaint), this counts as a data security breach under FADP Art. 24. The 72-hour clock starts from awareness.

Second: sub-processor incidents. An LLM provider had multiple incidents in 2025 where system prompts or responses leaked between accounts (the 20 Mar 2023 OpenAI incident is a known precedent). If a Swiss processor uses the provider as a sub-processor, they are notification-bound – even if the provider caused the incident.

Third: hallucination violations. An LLM invents false personal data about a specific person (e.g. invents crimes or debts that do not exist). If that hallucination is passed on or published, it violates processing principles (FADP Art. 6 – accuracy). With high risk, notification duty applies.

Fourth: training data leakage. A fine-tuned model that unintentionally returns original training content (memorization effect) can exfiltrate client data. Such cases are real (see Carlini et al. 2023, "Extracting Training Data") and notification-bound when personal data is affected.

The "high risk" threshold is legally vague – the FDPIC notification guidance (March 2024) names indicators: affected persons > 100, particularly sensitive data (health, religion, judicial), identity-theft risk, financial damage, reputation damage, discrimination risk.

Notification mechanics and FDPIC recommendations 2024-2026

FADP Art. 24 – notification duty in detail. The controller (not the processor) is bound to notify "where" the breach is "likely" to lead to a "high risk" to the personality or fundamental rights of affected persons. The 72-hour deadline from awareness matches GDPR Art. 33 substantively. The processor (e.g. the LLM provider) must in turn inform the controller "as quickly as possible", which is to be fixed contractually (DPA).

Notification channel: online form on www.edöb.admin.ch under "Notifications". Content of the notification: nature and scope of the breach, categories and number of affected persons, categories of affected data, consequences, measures taken. If not all information is available within 72 hours, the notification can be submitted in stages.

Information of affected persons (FADP Art. 24 para. 4): if the breach leads to a high risk for an individual and is necessary for protection, affected persons must be informed directly. Exceptions: disproportionate effort, public notice equally effective, overriding third-party interest.

FDPIC opinions 2024-2026 (selection). August 2024: recommendation on the use of generative AI in companies – emphases on transparency, purpose limitation, avoidance of sensitive data in public prompts, staff training, clear internal policy. November 2024: update of FAQs on the revised FADP with AI references. March 2025: opinion on AI in HR – applicant screening, performance assessments, application of FADP Art. 21 (solely automated individual decision). November 2025: recommendation on DPAs with US LLM providers under the Swiss-US Data Privacy Framework.

32nd Annual Report 2024/25 (published June 2025). Explicitly mentions: 38 ad-hoc consultations on AI projects from SMEs and public bodies, 14 with follow-up measures. Four formal investigations on AI processing, two with public recommendation (applicant screening platform with bias, creditworthiness scoring provider without transparency). No fines, but two recommendations with publication.

Response to an AI data protection incident in 6 steps

1. 01Identify and document the incident: time of awareness, data involved, persons involved, systems involved.
2. 02Immediate measures: lock the affected account, inform the LLM provider (DPA clause), preserve logs, internal escalation to DPO.
3. 03Risk assessment within 24h: high harm to personality or fundamental rights? Indicators: > 100 persons, sensitive data, identity theft, discrimination.
4. 04FDPIC notification within 72h of awareness: online form on edöb.admin.ch, partial filing with later supplementation if needed.
5. 05Inform affected persons if necessary for protection: in writing, with breach description, measures, contact point.
6. 06Follow-up: internal incident report, AI policy update, staff training, update of DPIA and processing register.

When the FDPIC path becomes relevant

Four patterns trigger the FDPIC path.

First: data protection breach with high risk. As soon as an AI incident becomes known and the risk threshold is met, the 72-hour clock starts. An internal threshold review must not unjustifiably extend the deadline – the FDPIC will, in case of doubt, assume the earlier awareness date.

Second: high-risk processing (DPIA duty under FADP Art. 22). For prior consultation, the controller may voluntarily consult the FDPIC – the FDPIC issues non-binding guidance typically within 4-12 weeks. For particularly sensitive data in high-risk AI processing, voluntary prior consultation is strongly recommended.

Third: response to access or deletion request (FADP Art. 25, 32). If a data subject requests access or deletion and the controller faces difficulties (e.g. because the LLM provider does not keep logs searchable), the data subject can lodge a complaint with the FDPIC.

Fourth: prior consultation for cross-border transfer scheme (FADP Art. 16 ff). If no recognition in the DSV Annex 1 list applies and no standard contractual clauses are available, the FDPIC may exceptionally consent to a transfer scheme under specific conditions.

When the FDPIC path is not the right channel

Three cases do NOT belong to the FDPIC.

First: cantonal supervision. Most cantons have their own data protection authorities for cantonal administrations, municipalities and in part hospitals. A list is maintained by privatim.ch (Association of Swiss Data Protection Commissioners). Examples: Zurich Data Protection Commissioner, Bern Data Protection Commissioner, Preposes cantonal Vaud.

Second: other supervisory authorities. FINMA for bank and insurance matters, FOPH for health data in specific contexts, Federal Audit Office for federal administration. Joint competence does occur – when in doubt, ask the FDPIC first; they will forward.

Third: economic competition, unfair competition, copyright. These are addressed via the Competition Commission, Unfair Competition Commission or civil courts, not via the FDPIC.

This is not legal advice. When in doubt about competence, legal counsel is recommended. The FDPIC accepts preliminary enquiries by email (info@edöb.admin.ch) and typically returns an initial assessment within 2-4 weeks.

Trade-offs

FAQ

Related topics

Sources

1. EDÖB – Homepage und Meldeformular · 2026-05
2. Bundesgesetz über den Datenschutz (DSG, SR 235.1) – Art. 24 Meldepflicht · 2023-09
3. EDÖB – Stellungnahme generative KI im Unternehmen · 2024-08
4. EDÖB – 32. Tätigkeitsbericht 2024/25 · 2025-06
5. EDÖB – Stellungnahme KI im Personalwesen · 2025-03
6. privatim.ch – Vereinigung der CH-Datenschutzbeauftragten · 2026-05