What Changed
- The FDPIC criticized management cultures for underestimating systemic data protection and transparency risks in large-scale digital transformation projects, leading to project delays.
- The FDPIC reported increased enforcement resources and concluded proceedings under the new Data Protection Act, alongside backlogs caused by increased Freedom of Information Act requests.
- The FDPIC concluded investigations into Ricardo AG/TX Group AG regarding tracking consent, and into Xplain, fedpol, and FOCBS regarding unauthorized vendor data transfers and storage.
The Federal Data Protection and Information Commissioner (FDPIC) of Switzerland has released updates and annual reports highlighting key enforcement actions, systemic compliance issues, and oversight under the Swiss Data Protection Act and the Freedom of Information Act.
These updates affect digital platforms, commercial entities, technology vendors, and public sector bodies operating in or interacting with Switzerland, including entities such as Ricardo AG, TX Group AG, Xplain, the Federal Office of Police (fedpol), and the Federal Office for Customs and Border Security (FOCBS).
Key regulatory highlights and enforcement conclusions from the FDPIC press releases include:
1. Digital Project Governance and Management Cultures: In the 2025/2026 Annual Report (published 30 June 2026) and an earlier activity report (25 June 2024), the FDPIC criticized management cultures that play down systemic data protection risks in large-scale digital transformation projects. The Commissioner emphasized that underestimating privacy, transparency, and the rule of law early in project planning leads to avoidable delays. Additionally, the 2025/2026 report noted that after 20 years, the Freedom of Information Act contains numerous coverage gaps.
2. Enforcement Under the New Data Protection Act: In the 2024/2025 Annual Report (published 1 July 2025), the FDPIC reported significantly increasing resources to address data protection violations and clarifying its approach to the new Data Protection Act through concluded proceedings. While mediation settlement rates under the Freedom of Information Act remained high, a surge in access and mediation requests created processing backlogs.
3. Investigation Findings and Recommendations:
- Ricardo AG and TX Group AG: On 23 October 2024, the FDPIC reported concluding its investigation (on 11 April 2024) into the Ricardo auction platform, recommending that Ricardo AG and TX Group AG obtain valid user consent and ensure transparency regarding data transfers and cross-platform tracking for targeted advertising.
- Xplain, fedpol, and FOCBS: On 1 May 2024, the FDPIC concluded investigations into technology vendor Xplain, fedpol, and FOCBS. The FDPIC identified Data Protection Act violations stemming from support process errors, where personal data was transferred without required safeguards and subsequently stored by Xplain in breach of data protection requirements and contractual duties.
Who May Be Affected
Digital platform operators, commercial advertisers, IT support vendors, and Swiss federal public sector entities.
Cross-Border Context
Cross-border companies and vendors offering services or executing ad-tracking and IT support processes within Switzerland must comply with Swiss federal data protection rules and consent standards.
What to check next
- Review official FDPIC annual activity reports and detailed investigation reports on Ricardo AG and Xplain on the FDPIC official website.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.
Prepared automatically with AI assistance from the official sources linked on this page. Translations and explanations do not replace the official text.