Federal Act on Data Protection (revised), of 25 September 2020

Instead of GDPR's three itemized triggers, Art. 3 uses a broad 'effects doctrine': the Act applies to circumstances that have an effect in Switzerland, even if initiated abroad — official guidance treats this as reaching foreign controllers who offer goods/services to, or monitor, persons in Switzerland, but the statute itself frames it as a general causation test rather than discrete triggers. Exemptions are narrow: purely personal/household use, parliamentary deliberations, and diplomatic-immunity institutional beneficiaries — there is no general nonprofit, government, small-business, or health/financial exemption; federal bodies are themselves covered.