In addition to the provisions of the Federal Act on Data Protection (FADP), the processing of employee data by an employer is governed by Article 328b of the Swiss Code of Obligations (CO). This provision allows an employer to process data concerning its employees only to the extent that the data relates to the employee's suitability for employment or is necessary for the performance of the employment contract. In addition to data processing that is strictly necessary for the performance of the employment contract, such as data relating to compensation and social security benefits, data processing within the scope of widely practiced human resources management may also be permitted. The processing of data which is outside the scope of the employer-employee relationship is prohibited unless there is an overriding interest of the employer, similar to the approach under the GDPR.

Centralised data processing often involves the transfer of employee data to other group companies outside Switzerland. Intra-group processing must always be carefully examined for its lawfulness on a case-by-case basis. Appropriate precautions will need to be taken to ensure compliance with the FADP in this respect.