A data breach: tell the FDPIC if the risk is high
Updated on October 24, 2026
Article 24 FADP requires the controller to notify the Federal Commissioner of a personal-data breach likely to result in a high risk to the personality or fundamental rights of the data subject. Notice is given as soon as possible and states the nature of the breach, its consequences and the measures taken. If protection of the person so requires, the controller also informs them. Not every incident is notifiable. The test is the high risk, which the business documents. The FDPIC indicates the notification channel.
The relevant article
Document the assessment, even when the business concludes the risk is not high. First limit access, then notify.