ChatGPT and Data Protection in Switzerland

Short answer

• The revised Federal Act on Data Protection (FADP) has been in force since 1 September 2023. According to the Federal Data Protection and Information Commissioner (FDPIC), it applies directly to AI, and so to ChatGPT as soon as a prompt contains personal data.
• A private account (Free, Plus, Pro) is a contract between your employee and OpenAI, with no data processing agreement, and content can flow into model training. With ChatGPT Business or ChatGPT Enterprise and a signed data processing agreement (OpenAI calls it the "Data Processing Addendum", DPA for short), OpenAI Ireland becomes your company's processor. It may then process the data only on your behalf. Training is off by default on both plans.
• To set this up, you choose a plan, sign the DPA, check retention and write a one-page internal rule. Your privacy notice then names the foreign countries the data goes to and the recipients.
• I recommend one rule to every team, even with a company contract, covering four kinds of data that never go into a prompt as they are: sensitive personal data, data under professional secrecy, employee data, and trade secrets and credentials. At most a placeholder goes in, and my rule goes further for employee data, where appraisals, salary details and medical certificates stay out entirely.
• OpenAI offers storage in the Europe region (EEA and Switzerland) for new workspaces on ChatGPT Enterprise and on Edu (its plan for universities), and for eligible customers who build their own applications on its programming interface (API). OpenAI is gradually rolling out a choice of storage region for Business, not yet for every customer.

Where a prompt with customer data actually goes

One copied customer email, three stops

Stop one is a laptop in your office. A member of staff copies a customer's email, with name and address, into her private ChatGPT Plus account and asks for a friendly reply. Stop two is a company in Ireland. For users resident in Switzerland, OpenAI Ireland Limited is the controller of this data (OpenAI's privacy policy). Stop three is servers in the US, one of the places where OpenAI processes the data according to the same policy.

OpenAI is the controller, so it decides itself what happens to the content, and on a private account the content can flow into model training. That role counts for more than the places the data passes through. A processor, by contrast, may only do with the data what your company instructs. Your company does not appear in this contract.

Why this concerns you personally

The revised FADP primarily fines people. Art. 61 provides for fines of up to CHF 250,000 for private persons who act wilfully, for example for an unlawful disclosure abroad (letter a) or an outsourcing that does not comply with Art. 9 (letter b). The Act uses private persons as the counterpart to federal bodies, and while its rules bind private companies, the fine falls on a person who works there. Prosecution happens only on complaint, meaning that someone affected has to file a criminal complaint first. According to the Federal Council, breaches of duties that lie with the company are attributed to its managers, not to staff who merely carry out instructions. I would leave it to a lawyer to say whether the member of staff in the example above breaks one of the duties Art. 61 lists. If she does, and if she acted on her own initiative rather than on instructions, she can be liable herself.

For offences committed in a business, Art. 64 para. 1 refers to the Federal Act on Administrative Criminal Law. Art. 6 of that Act provides that not only the person who acted can be liable, but also a superior who, in breach of a legal duty, wilfully fails to prevent the offence. The business can be fined under Art. 64 para. 2 instead of a person, but only for fines up to CHF 50,000 and when identifying the responsible persons would take disproportionate effort.

What the revised FADP requires for ChatGPT

You can find the FADP articles quoted here in the Federal Act on Data Protection on fedlex. The citations use "let." for letter, the lettered item within a paragraph.

A name in the prompt is enough

Under Art. 5 let. a FADP, personal data is any information relating to an identified or identifiable natural person. A customer email with a signature meets that, and a CV certainly does. On 8 May 2025 the FDPIC stated that the current data protection law applies directly to AI.

OpenAI as processor, but only with a contract

Art. 9 allows you to outsource data processing to a provider if the provider only processes the data in the way you yourself would be allowed to, and no duty of confidentiality prohibits it (para. 1 let. b). You must also satisfy yourself that the provider is able to guarantee data security (para. 2). You can hardly show either without a DPA.

OpenAI Ireland Ltd. is the contracting party and processor for Swiss customers under OpenAI's DPA in the version in force since 1 January 2026. This contract is available for Business, Enterprise and the API.

Data abroad

As a rule, Art. 16 allows disclosure abroad only if the country offers adequate protection or if safeguards such as standard data protection clauses are in place. Ireland is on the list of adequate countries in Annex 1 of the Data Protection Ordinance, as of 15 September 2024. The US counts as adequate there only for organisations certified under the Swiss-U.S. Data Privacy Framework.

Clause 4.1 of OpenAI's DPA bases transfers outside the EEA and Switzerland, including those onward from Ireland, on standard contractual clauses (model contract terms for such transfers) or on a decision by the European Commission that a country's protection is adequate. The DPA as published on OpenAI's website does not name the Swiss FADP explicitly. I would have a lawyer check this point before signing.

Transparency towards customers and staff

If personal data goes abroad, you must tell the people concerned which country it goes to and, where applicable, which safeguards apply (Art. 19 para. 4). This usually goes in your privacy notice. The FDPIC stresses that people who communicate directly with a language model have a right to know whether they are corresponding with a machine and whether their input is processed further, which matters as soon as you put a chatbot in front of your customers.

When a data protection impact assessment is due

If processing may result in a high risk, Art. 22 requires a data protection impact assessment, a prior check of the risks for the people concerned. In particular, the law names the extensive processing of sensitive personal data. A medical practice that sends large numbers of patient reports through an AI tool would likely fall under it.

Which ChatGPT plans offer which data controls

Free, Plus and Pro: private contracts

OpenAI runs these three plans as services for individuals. Content can flow into model training, and you can switch that off with the setting "Improve the model for everyone" (help article on training). Feedback with a thumbs up or down can still bring the whole conversation into training even then.

Temporary Chat is not used for training and is kept for up to 30 days (data controls in ChatGPT).

Both settings improve protection, but your company is not a party to the private contract between your employee and OpenAI, so there is nothing you could secure under Art. 9. Whether the opt-out is on depends on each employee, and as a business you cannot show that it is.

The overview of the ChatGPT plans lists what the paid private subscriptions cost and how much use they allow.

ChatGPT Business: the entry point for teams

ChatGPT Business is aimed at companies and starts at two users, according to OpenAI. Content does not flow into training by default (enterprise privacy page), and there is a DPA for Business, with OpenAI Ireland as the contracting party for Swiss customers. For company data, that makes Business the first ChatGPT tier with both.

Admins set how long chats are kept and deleted content is generally removed within 30 days, OpenAI says. Check this in your own workspace. OpenAI also cites a SOC 2 Type 2 report for Business, an external audit of its security controls.

OpenAI's price list still shows no data residency (a fixed storage region) for Business. A choice of storage region is rolling out gradually for Business and is not yet available to every customer, according to a help article from October 2026. Even then, a copy of every prompt and response is also stored in the US for a limited time for abuse monitoring.

ChatGPT Enterprise: when the storage location matters

ChatGPT Enterprise offers data residency in the "Europe (EEA + Switzerland)" region for new workspaces (help article on data residency). There is no Switzerland-only region. Eligible workspaces can optionally keep inference (the computing of the answers on the graphics processors) in Europe too. Other steps such as sign-in and routing can still run elsewhere.

Apps that connect ChatGPT to other services, MCP (interfaces to external tools) and web search are among the features exempt from residency. If a chat with customer data uses web search, the storage commitment does not cover that part.

With Enterprise you still need the DPA and the internal rule, because data residency replaces neither.

And Microsoft Copilot?

For companies on Microsoft 365, Copilot is the obvious alternative. Enterprise Data Protection applies to organisational accounts. Microsoft acts as processor under the DPA and does not train foundation models with your content.

The EU Data Boundary covers the EU and the EFTA states, Switzerland included. A Swiss tenant (your Microsoft 365 environment) can therefore be processed within that boundary. You have to check for your own tenant whether your Copilot data actually stays there.

Bing web search is the first of two exceptions, because there Microsoft is a controller in its own right and not your processor. Copilot can also use models from Anthropic (another AI provider), and these are currently excluded from the EU Data Boundary.

The plans at a glance

• Free, Plus, Pro: training possible, each user sets the opt-out themselves. No contract with your company, only a private contract with OpenAI. OpenAI Ireland is the controller, with servers also in the US. Temporary Chat kept for up to 30 days. Not suitable for personal data from the company.
• ChatGPT Business: training off by default, DPA with OpenAI Ireland. Admins set the retention period and deleted content is generally removed within 30 days, according to OpenAI's FAQ. Choice of storage region only in a gradual rollout, with a copy of prompts and responses kept in the US for abuse monitoring. Suitable with an internal rule.
• ChatGPT Enterprise: training off by default, DPA with OpenAI Ireland. According to OpenAI, admins set the retention period. Europe region (EEA and Switzerland) for new workspaces, with exceptions such as apps, MCP and web search. Suitable with an internal rule, including when the storage location matters.
• Microsoft Copilot (organisational account): no training of foundation models, DPA with Microsoft as processor. Retention not compared here. EU Data Boundary including Switzerland possible, without Bing web search and Anthropic models. Suitable with an internal rule, mind the exceptions.

The last sentence of each item is my assessment. The other details come from the OpenAI and Microsoft documents linked above.

Which data never goes into ChatGPT as it is

Real names and values from these four groups never go into a prompt, at most a placeholder, and some data stays out entirely. I recommend this rule even with a Business or Enterprise contract, because a DPA governs who processes the data and how, but leaves open which information belongs in a prompt at all.

Sensitive personal data

Art. 5 let. c FADP lists what is particularly sensitive, including data on health, religious and political views, ethnic origin, biometric data that uniquely identifies a person, criminal proceedings and social assistance. Consent for this data must be explicit where consent is required (Art. 6 para. 7). Even with such consent, I would put this data into a prompt only as a placeholder, for example the diagnosis in a customer letter.

Professional secrecy

Doctors, lawyers, notaries, auditors, psychologists and their assistants are bound by professional secrecy under Art. 321 of the Swiss Criminal Code, and a breach is punishable, on complaint, with a custodial sentence of up to three years or a monetary penalty. Art. 9 para. 1 let. b FADP adds that outsourcing is not permitted where a duty of confidentiality prohibits it.

I cannot answer here whether pasting a case into ChatGPT already falls under Art. 321 of the Criminal Code, and whether a DPA is enough for people bound by professional secrecy. Both are questions of interpretation, so my rule is that client and patient data never go into the prompt with real names or other details that identify the person. "Mrs Keller, born 1961" becomes "Patient A" before anything is copied.

Employee data

Art. 328b of the Code of Obligations allows employers to process data about employees only to the extent that it concerns their suitability for the job or is needed to perform the employment contract. I go beyond placeholders here, because in a small team a placeholder rarely hides who is meant. Appraisals and salary details stay out entirely, and so do medical certificates, which are also health data and so count as sensitive personal data.

Trade secrets and credentials

Remove or replace passwords, API keys, draft contracts with third parties and competitors' quotes before pasting. An API key in a chat history is a key you no longer control alone.

Besides chat services like ChatGPT, there are AI assistants that run as a program on your own computer and can open files there, while the model behind them runs at the provider. With the one I work with, I do not rely on discipline alone. A technical block stops it from opening the files where software typically keeps its passwords and keys, such as .env files, and from displaying keys stored in environment variables (settings that programs on the computer read). Without the block, a key the assistant read would become part of the conversation, which is sent to the provider and stored in the assistant's session logs.

How to introduce ChatGPT in your team under the FADP

Step 1: choose a plan and sign the data processing agreement

Stop using private accounts for company data. Choose Business or, if storage in Europe matters, Enterprise, and sign the DPA with OpenAI.

Step 2: adjust the settings

Set how long chats are kept, if your plan offers that setting. Decide which apps and connectors your team needs, and record the list in the internal rule. Also settle whether web search is needed for chats with customer data, since with Enterprise it sits outside data residency.

Step 3: a one-page internal rule

The rule fits on one page if it answers four questions: What may go in? What never? How do you replace names with placeholders? Who decides when someone is unsure? Put an example of the placeholders right on the page, such as "Customer A, amount X" instead of real names and figures.

Step 4: privacy notice and record of processing

Add to your privacy notice the foreign countries the data goes to and, where applicable, the safeguards under Art. 16, as Art. 19 para. 4 requires. I would also name OpenAI there as a recipient. And check whether your business has to keep a record of processing activities, a list of which personal data you process and for what. Art. 24 of the Data Protection Ordinance exempts businesses with fewer than 250 employees, with the exceptions in the FAQ below.

Step 5: check and report incidents

If patient data or a personnel file ends up in a private account despite the rule, check whether there is a data security breach that must be reported. Art. 24 para. 1 of the Act itself (FADP), not the ordinance, requires you to report it to the FDPIC "as quickly as possible" if it is likely to lead to a high risk for the people concerned.

Sort out your team's ChatGPT use

Does your team already use ChatGPT, but you do not know on which accounts? In a first call, I look at which accounts your team uses today and what the move to a company plan takes. Or read more articles on the seelig.ai blog first.

Frequently asked questions