Federal Act of 25 September 2020 on Data Protection

Article 25 Right of access
1 Any person may request information from the controller on whether personal data relating to them is being processed.

2 The data subject shall receive the information required to be able to exercise their rights under this Act and to guarantee transparent data processing. In every case, they are entitled to the following information:

a. the identity and the contact details of the controller;
b. the processed personal data as such;
c. the purpose of processing;
d. the retention period for the personal data or, if this is not possible, the criteria for determining this period;
e. the available information about the source of the personal data, if it has not been collected from the data subject;
f. if applicable, whether an automated individual decision has been taken and the logic behind the decision;
g. if applicable, the recipients or the categories of recipients to which personal data is disclosed, as well as the information specified in Article 19 paragraph 4.

3 The data subject may consent to having personal data relating to their health communicated to them by a health professional of their choice.

4 If the controller arranges for personal data to be processed by a processor, it remains under a duty to provide information.

5 No one may waive, in advance, their right of access.

6 The controller must provide the requested information free of charge. The Federal Council may provide for exceptions, in particular if the effort required is disproportionate.

7 The information shall in general be provided within 30 days.

Article 26 Limitations on the right of access
1 The controller may refuse to provide information, or restrict or delay the provision of information if:

a. a formal law so provides, in particular in order to preserve professional secrecy;
b. this is required to safeguard overriding third-party interests; or
c. the request for access is obviously unjustified, in particular if it does not serve the purpose of data protection or is clearly procedural.

2 Furthermore, it is possible to refuse, restrict or delay the provision of information in the following cases.
a. The controller is a private person and the following requirements are satisfied:
1. The controller's own overriding interests require the measure.
2. The controller does not intend to disclose the personal data to third parties.
b. The controller is a federal body, and one of the following requirements is satisfied:
1. The measure is required to satisfy overriding public interests, in particular Switzerland's internal or external security.
2. The communication of the information may compromise an enquiry, an investigation or administrative or judicial proceedings.

3 Legal entities that belong to the same group of companies are not third parties within the meaning of paragraph 2a number 27.

4 The controller must indicate why it is refusing, restricting or delaying the provision of the information.

7 Corrected by the Drafting Committee of the Federal Assembly (Article 58 para. 1, Parliament Act, SR 171.10).

Article 27 Limitation on the right of access for the media
1 If personal data are processed exclusively for their publication in the editorial section of a periodically published medium, the controller may refuse, restrict or delay the provision of information for one of the following reasons:

a. The data reveal the sources of the information.
b. The provision of information would allow access to drafts of publications.
c. The provision of information would compromise the freedom of the public to shape their own opinions.

2 Journalists may also refuse, restrict or delay the provision of information if they are using the personal data exclusively as an aid to their own personal work.