The Swiss Federal Data Protection Act (DPA) defines personal data as "all information relating to an identified or identifiable person".

"Person" refers not only to a natural person (individual), but also to a legal entity. The legal form of the entity is not relevant. Accordingly, personal data under the DPA can mean data relating to individuals as well as to partnerships, corporations, associations, cooperatives or any other legal entity. The extension of protection for data relating to legal entities can create difficulties in the context of cross-border data transfers because few other countries provide adequate protection for data relating to legal entities.

A person is "identified" or "identifiable" if the information permits the identification of the person concerned. A person can be identifiable even if the data is stored in an anonymous form, e.g., under a code number, but separate information allows a link to be made between the code and the identity of the person. A person will be deemed not to be identifiable only if the information is anonymous and no link can be established between the anonymous information and the person concerned.

FADP classifies personal data as “sensitive personal data” if it relates to:

• religious, philosophical, political or trade union-related views or activities;
• health, the intimate sphere of the person or racial origin;
• genetic data;
• biometric data which unequivocally identifies a natural person;
• administrative or criminal proceedings and sanctions;
• social security measures.

Financial data is not sensitive personal data under the FADP. Switzerland's banking secrecy law, however, protects the confidentiality of the existence of the banking relationship, the identity of the bank's customer and any other information related to the banking relationship.

For sensitive personal data, more stringent requirements particularly apply to the consent of the data subjects to their processing (if consent is required, which is not generally the case). If extensive processing of particularly sensitive personal data is planned, there may be a high risk that leads to private controllers having to carry out a data protection impact assessment in advance.

“Profiling” means any type of automated processing of personal data which seeks to evaluate certain personal aspects relating to a natural person. In particular, it attempts to analyse or predict aspects of that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

In addition, there is also “high-risk profiling”. This is a profiling that entails a high risk to the personality or fundamental rights of the data subjects by leading to a combination of data that allows an assessment of essential aspects of the personality of a natural person.

In principle, consent is not required for data processing under the FADP. In exceptional cases where consent is required, it must be given explicitly in the case of high-risk profiling.