Compared to the previous law, the FADP now gives more power to the FDPIC. In particular, the FDPIC can issue binding orders. These include orders to cease processing, or to destroy personal data or cease disclosure abroad, as well as orders to carry out a data protection impact assessment or give information to data subjects.

The FADP provides for criminal sanctions of up to CHF 250,000 in the event of an intentional breach (including contingent intent) of certain provisions; for example in the case of a breach of the information obligation, or incomplete or inaccurate information in the case of a data subject access request, or where a controller uses a processor without entering into a processing agreement. These sanctions are directed against the individual responsible for the breach (including members of management but not limited to them).