Since the revised Federal Act on Data Protection (FADP) came into force in September 2023, the Federal Data Protection and Information Commissioner (FDPIC) can issue binding orders instead of mere recommendations. In 2026 it is clearly using that power.
1. The FDPIC Orders a Stop to Bodycams
In an order dated 29 September 2026, the FDPIC concluded its investigation into Baselland Transport AG (BLT), which had equipped ticket inspectors with bodycams since January 2026. The FDPIC ordered the company to stop the data processing and delete the personal data collected.
The reasoning: neither the Passenger Transport Act nor other federal legislation provides a legal basis for bodycams in this context. The FDPIC acknowledged the company's interest in protecting its staff but found that this does not justify any additional measure that interferes with fundamental and personality rights. BLT has announced an appeal to the Federal Administrative Court and continues to use the cameras until the proceedings are concluded.
The lesson: where a company performs public tasks or relies on a specific legal framework, a legitimate interest is not automatically enough. Surveillance measures need a solid legal basis and a documented proportionality assessment.
2. Other FDPIC Activity
- AI: the FDPIC concluded a preliminary investigation into the AI model Grok after its operator introduced an opt-out mechanism for users
- Video analytics: it reviewed AI-supported video surveillance at a retailer's self-checkouts and found the processing compliant
- Access requests: handling of access requests under Article 25 FADP remains an enforcement priority — standardised, incomplete answers have already led to a reprimand
3. The Legal Framework at a Glance
- The FDPIC can open investigations and issue binding orders, which can be appealed to the Federal Administrative Court
- Criminal fines of up to CHF 250,000 are imposed on the responsible individuals, not on the company
- Data breaches that are likely to result in a high risk must be reported to the FDPIC as soon as possible
- Switzerland holds an EU adequacy decision, so personal data can flow from the EU to Switzerland without additional safeguards
Your Checklist
- Review surveillance measures — cameras, bodycams, monitoring tools — for their legal basis and proportionality
- Carry out a DPIA where processing is likely to be high risk
- Test your access request process for complete, individual answers within 30 days
- Check your AI tools for transparency and opt-out options
How ResGuard Can Help
The ResGuard Data Protection Manager supports records of processing, DPIAs and access requests under the FADP, and our data protection advisor service for Switzerland helps you implement them.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: FDPIC order of 29 September 2026 as reported by Swiss media, and published commentary on FDPIC enforcement.