Patient data is caught between the conflicting priorities of medical treatment and data protection law. Doctors, therapists and other healthcare professionals need to process sensitive health data in order to do their jobs, but at the same time they are obliged to protect their patients’ privacy and personal rights.

This tension is particularly evident in the collection, transfer and storage of data in everyday practice – for example, in patient forms for registration, consent or treatment documentation. The Federal Data Protection and Information Commissioner (FDPIC) has published a new factsheet on patient forms for medical and therapeutic consultations. It specifies how information obligations, consent and data security can be implemented in a legally compliant manner in the treatment environment.

With this publication, the EDÖB aims to raise awareness among service providers such as doctors, therapists, practices and health centres of the requirements of the revised FADP and to bring existing form templates into line with data protection regulations.

Duty to provide information and consent – two separate obligations

The factsheet makes it clear that anyone who processes health data has a comprehensive duty to provide information, regardless of whether consent has been obtained. Healthcare professionals must inform patients transparently about data processing: the purpose, legal basis, recipients and retention period must be disclosed in a comprehensible manner (Art. 19 FADP).

Consent comes into play as a supplementary measure if there is no other legal basis or if particularly sensitive processing is carried out, such as when data is transferred to third parties or for research purposes. The following applies: valid consent must be voluntary, informed, specific and revocable at any time. Blanket or pre-filled consent forms – such as prior disclosure of the patient file or certain elements thereof to third parties – are inadmissible.

The factsheet urges service providers to critically review their forms: information and consent sections must be clearly separated and formulated in an understandable manner. Those who comply with this reduce the risk of data protection violations and at the same time build trust in patient contact.

Digital exchange of data – safety over convenience

Another focus is on the secure handling of patient data in digital communication. The factsheet expressly warns against the unsecured transfer of sensitive data – especially by e-mail or online form without encryption.

Digital data transfer should only happen if it’s properly secured. Only in special cases – and after getting clear, informed consent from the person involved – can a less secure transfer be okay. In these cases, the patient needs to know the risks and have a real choice (like between a secure portal and regular email).

The implementation of technical and organisational security measures is crucial, especially in increasingly digitised practices. Anyone who transfers patient data via unsecure channels risks not only data protection complaints, but also liability consequences.

Data minimisation and purpose limitation – less is more

The FDPIC points out that only data that is absolutely necessary for treatment or administration may be collected in the healthcare sector. The principle of proportionality requires that patient data be collected for a specific purpose, be accurate and be collected as sparingly as possible.

Forms that request excessive information – such as occupation, nationality or marital status without any medical relevance – are not permitted. All information collected must serve a clear purpose and be medically or administratively necessary.

Doctors and therapists may find this reference to the principle of proportionality somewhat objectionable. In practice, this is difficult to implement without enormous additional effort. However, these requirements are not aimed at bureaucracy, but at trust: lean, purposeful data collection protects both patients and practices from unnecessary data protection risks.

Significance & Practical Recommendations for Healthcare Providers

The new information sheet is a wake–up call for all healthcare providers – from individual practices to therapy centres. Anyone who processes patient data should now check:

    • Are my patient forms understandable, up to date and compliant with data protection regulations?

    • Are the duty to provide information and consent clearly separated and documented?

    • Is digital communication sufficiently secure from a technical standpoint?

    • Is only data that is actually necessary being collected?

A practice that complies with data protection regulations not only strengthens legal certainty, but also patient trust – the foundation of all medical activity.

Frequently asked questions on data protection and patient forms Datenschutz

No. There is a legal basis for most processing carried out as part of medical treatment (Art. 31 para. 1 FADP, cantonal health laws). Express consent is only required if data is processed outside the scope of the treatment order or passed on to third parties – for example, for research purposes, marketing or insurance assessments. It is crucial that every patient is informed about data processing, even if consent is not required.

Yes, but only with a clear separation of functions. The EDÖB emphasises that the duty to provide information and consent must be distinguishable in terms of content and visually. Patients must understand which processing operations are mandatory (by law) and what they are voluntarily consenting to. It is advisable to use separate sections or checkboxes to ensure that consent is voluntary.

Health data is classified as particularly sensitive personal data (Art. 5 lit. c FADP). It may only be transferred electronically if the confidentiality and integrity of the data is guaranteed – for example, through encrypted emails, secure patient portals or specialised communication solutions. Unencrypted transfer is only permitted if the patient gives their express consent after receiving comprehensive information.

No. The Federal Act on Data Protection obliges service providers to minimise data collection: only information that is necessary for diagnosis, treatment or administrative purposes may be collected. Questions about occupation, religion or marital status are only permissible if they have a clear medical relevance.

Yes. Consent must be revocable at any time. The revocation is valid from the time of its declaration and takes effect for the future. However, data that has already been processed lawfully (e.g. for treatments carried out or services invoiced) may continue to be stored if there are legal obligations to do so, such as for documentation or invoicing purposes.

In its ruling, the court refuses to unseal seized data carriers and documents belonging to a journalist, thereby strengthening freedom of press. The current decision of the Zurich District Court of 2 July 2025 deals with the unsealing of seized data carriers and documents in the case of Inside Paradeplatz journalist Lukas Hässig, after the journalist correctly filed for sealing on the grounds of protecting his sources. The decision of the Compulsory Measures Court shows the conditions under which a request for unsealing is approved or, as in this case, not approved.

Facts and background of the Hässig case

The focus is on an investigative journalist, editor of the Inside Paradeplatz platform. He is accused of sharing information and data from Bank Julius Bär & Co. AG, which is subject to banking secrecy and/or trade secrets, in his magazine ‘Inside Paradeplatz’. In connection with the resumption of criminal proceedings against the respondent for an offence under Article 47 Banking Act, a search was carried out at his home and place of work. Various items and data carriers were seized. Referring to the protection of journalistic sources, the respondent requested that all seized items be sealed.

The public prosecutor’s office then filed a request for unsealing with the Compulsory Measures Court of the Zurich District Court. The respondent commented on the request for unsealing and requested that it be dismissed.

Note: The judgment shows that the criminal investigation by the public prosecutor’s office had already been suspended twice. In the most recent suspension order, the public prosecutor’s office itself had denied the admissibility of a search on the grounds of source protection, which the court took up in its judgment.

Legal requirements for unsealing

A request for sealing is used to assert permissible confidentiality interests pursuant to Article 248 para. 1 of the Swiss Criminal Procedure Code when searching records. Once the request for sealing has been filed, the criminal authority first seals the seized data carriers and documents. In the unsealing proceedings, the Compulsory Measures Court is then obliged to examine any objections to the admissibility of the search. A general decision must therefore be made as to whether the search is admissible.

A search of records within the meaning of Article 246 ff. Swiss Criminal Procedure Code, i.e. ‘documents, audio, video and other recordings, data carriers and equipment for processing and storing information’, is permissible if:

According to Article 246 of the Swiss Criminal Procedure Code, documents, audio, video and other recordings, data carriers and equipment for processing and storing information may only be searched if there is reason to suspect that information subject to seizure is contained in these items. According to Article 263 para. 1 of the Swiss Criminal Procedure Code, items and assets that are used as evidence (lit. a) are subject to seizure if they are needed to secure procedural costs, fines, penalties and compensation (lit. b), if they are to be returned to the injured party (lit. c), confiscated (lit. d) or used to cover claims for compensation by the state in accordance with Article 71 of the Swiss Criminal Code.

Unlike the court of law, the Compulsory Measures Court does not have to exhaustively weigh up all incriminating and exonerating evidence. What is required is a sufficiently concrete probability that the alleged offence was actually committed. According to the highest court ruling, reasonable suspicion can be equated with the concept of initial suspicion pursuant to Article 309 para. 1 lit. a of the Swiss Criminal Procedure Code.
Compared to pre-trial detention (Art. 224 ff. Swiss Criminal Procedure Code), the unsealing and searching of records appears to be significantly less intrusive. The requirements for reasonable suspicion are therefore less stringent. Reference can be made to substantiated criminal complaints or reports. The grounds for suspicion must be examined on the basis of the results of the investigation to date.

Furthermore, the Compulsory Measures Court must weigh up the interests involved and examine whether the house search and the search of the sealed data are proportionate to the constitutionally protected intimate and private sphere of the respondent.
The owner of the records or objects may request sealing if there are obstacles to seizure in accordance with Article 264 of the Swiss Criminal Procedure Code (Art. 248 Swiss Criminal Procedure Code). These obstacles to seizure also prevent the unsealing of previously sealed records and objects.

When assessing the proportionality of this compulsory measure, the severity of the offences under investigation is also taken into account (Art. 197 para. 1 lit. d Swiss Criminal Procedure Code).

Considerations of the coercive measures court in its ruling of 2 July 2025

No reasonable suspicion

The criminal investigation against the respondent has now been ongoing for six years. The investigation files do not indicate that the suspicion against the respondent has intensified in recent years or at least months. The Compulsory Measures Court finds that no suspicion against the respondent can be established, even to a minimal degree. Sufficient suspicion is denied.

Proportionality and source protection

The public prosecutor’s office argues that the respondent cannot invoke source protection under Art. 28a para. 1 of the Swiss Criminal Code and Art. 172 of the Swiss Criminal Procedure Code and thus a right to refuse to give evidence. The Compulsory Measures Court argues that the respondent acted in the interests of society and fulfilled his duty as an investigative journalist. It considers the priority given to criminal prosecution and possible punishment for a breach of banking secrecy over the legitimate right of the public to be informed about alleged far-reaching violations of the law in the financial sector to be manifestly wrong. According to the Compulsory Measures Court, the interest in prosecution in this case is not sufficiently weighty to outweigh the protection of sources. The proportionality of the search must also be denied.

Finally, the Compulsory Measures Court finds that the conditions for unsealing and searching the seized data carriers and documents are not met.

Significance for the media, lawyers and those affected

The ruling thus rightly emphasises the high hurdles for interference in journalistic work. Source protection enjoys strong protection in Switzerland, as it is enshrined in the Constitution and the ECHR. Finally, criminal proceedings such as the unsealing and searching of records require careful consideration of the interests involved – especially in the case of media professionals.

For affected journalists and media companies, this means that access to confidential data is only permitted in exceptional cases where there are concrete and serious grounds for suspicion of criminal activity.

Our law firm provides advice on criminal procedure law, media law, source protection and the enforcement of personal rights. Please feel free to contact us without obligation if you have any questions about criminal proceedings and the search of records.

FAQ Criminal proceedings and sealing:

  1. How does the sealing of data carriers or documents occur in criminal proceedings?

Seized data carriers or documents are sealed if the person concerned claims that the contents of the records are subject to special protection, for example due to professional secrecy (e.g. protection of journalistic sources, lawyers, doctors). Sealed data may only be searched after a court decision has been made.

  1. Under what conditions can a request for unsealing be successful?

To this end, the public prosecutor’s office submits a request for unsealing to the Compulsory Measures Court. Unsealing is possible if there is concrete and sufficient suspicion against the person concerned and the search appears proportionate to their fundamental rights. The Compulsory Measures Court always examines the proportionality and the suspicion.

  1. What is the right to refuse to give evidence and who can invoke it?

The right to refuse to give evidence allows certain professional groups – e.g. lawyers, journalists, doctors – to refuse to testify and to keep their sources or client data confidential. This protection applies as long as they are not suspected of having committed serious crimes themselves.

The right to refuse to give evidence allows any person to refuse to testify during questioning for their own protection (Art. 169 Swiss Criminal Procedure Code) or to protect personal relationships such as their spouse or close relatives (Art. 168 Swiss Criminal Procedure Code). However, sealing is only protected under Art. 264 of the Swiss Criminal Procedure Code in cases of qualified confidentiality protection, e.g. items and documents from another person’s communications with their lawyer.

  1. Is the protection of journalists’ sources also guaranteed in court?

Yes, journalists can invoke source protection. Courts and public prosecutors may only seize and unseal their data in exceptional cases – namely when there are clear indications of a criminal offence and public interests, namely in the criminal investigation, outweigh other considerations.

  1. What can I do if I receive a summons to appear as a witness but wish to refuse to provide information?

You must attend the appointment, but you can exercise your right to refuse to give evidence if you are bound to secrecy as a relative or because of your profession. Inform the authorities of this in good time and seek legal advice if necessary.

The Federal Data Protection and Information Commissioner (FDPIC) has published his 2024/2025 activity report. In his press release, he headlines ‘Increased intervention against data protection violations and new highs in access requests under the Freedom of Information Act’ and draws a much-noticed summary of digitalisation and fundamental rights, both in the public sector such as the judiciary, police, security and health, but also in business and society. In the private sector, the following topics stand out in particular:

Cyberattack on OneLog: Risks associated with login solutions

The FDPIC documents a targeted cyberattack on the OneLog login platform. The incident clearly shows that cloud-based authentication services are becoming attractive targets for hackers – with potentially far-reaching consequences for thousands of private individuals. The report calls for strict security and incident response processes at identity providers. Those responsible not only have a duty to report data security breaches (Art. 24 para. 1 FADP), they must also continuously inform the FDPIC about the measures taken and the next steps.

Duty of representation (Art. 14 FADP): Clear responsibility in the private sector

The FADP now clearly requires representation in accordance with Art. 14 FADP for private individuals domiciled or resident abroad who process personal data. This means that anyone who processes data extensively and regularly – e.g. in the context of private online platforms or community services – must appoint an elected or appointed person who is responsible for compliance with the FADP. This strengthens the traceability of data protection-relevant processes. To this end, companies and other private individuals can appoint a representative as a point of contact for both the data subjects and the FDPIC.

BPS Legal offers representation in accordance with Art. 14 FADP, possibly in combination with the role of Swiss data protection advisor in accordance with Art. 10 FADP. Please feel free to contact us.

Cross-platform tracking: on the watchdog’s radar

Particularly interesting for online marketing: the FDPIC is focussing on cross-platform tracking, e.g. using cookies or fingerprinting. The FDPIC notes that such methods in the private sphere often take place in a legal vacuum – and calls for clear rules on transparency, consent and documentation. Without suitable technical and organisational measures, there is a risk of fines and loss of reputation. When using third-party services and third-party cookies by website and app operators, information obligations, design rights of the data subjects and responsibilities must be observed.

Data protection is becoming part of the corporate culture

In the 2024/2025 activity report, the FDPIC shows that data protection is being taken increasingly seriously in the private sector. From cloud security to tracking regulation – the figures speak for themselves. For platform operators, SMEs and private individuals, proactive legal advice is more important than ever to create legal certainty and trust. The full report is available from the FDPIC at: https://backend.edoeb.admin.ch/fileservice/sdweb-docs-prod-edoebch-files/files/2025/07/01/de77df3c-8cdb-4a72-9109-6783d8218fbc.pdf

Contact us for non-binding advice on data protection law and digitalisation.

FAQ: Questions and answers on data protection for SMEs and platform operators

The incident shows that centralised login services pose a high security risk. Platform operators must ensure that authentication processes are specially protected – with strong passwords, two-factor authentication and a functioning security and emergency management system. Data security breaches must also be reported quickly.

Companies based abroad that systematically process personal data of people in Switzerland must appoint a data protection representative in Switzerland. Smaller operators of websites or platforms may also be affected – for example, if they regularly process data from Swiss users. The representative must be identified transparently in the data protection notice.

Anyone who tracks user behaviour across different websites and devices requires the explicit consent of the data subjects. The use of cookies, pixels or fingerprinting tools without clear consent is contrary to data protection law. SMEs need to review and adapt their cookie banners and tracking processes both technically and legally.

 

If a company carries out particularly risky data processing – such as systematic tracking, profiling or the processing of health data – a data protection impact assessment is often required. The FDPIC’s latest report shows an increase in the number of such audits of data controllers. SMEs should clarify at an early stage whether a DPIA is necessary in order to prevent subsequent legal consequences.

The new Data Protection Act requires data security breaches to be reported to the FDPIC immediately – if there is a high risk for the data subjects. Delayed or incomplete reporting can be considered a breach of duty. SMEs should establish clear internal reporting processes.

As a company, it is worth recognizing which tasks should be handled in-house and where the company is better off concentrating on its core business in order to increase efficiency and reduce costs. Particularly in IT, it makes sense to consider bringing in an external service provider, if not only then also for information security reasons. And while companies and service providers like to focus on performance, both would do well to be able to answer the fundamental questions of data protection.

Outsourcing from a data protection perspective

Cloud providers, web hosts, agencies and call centres or IT support companies take on tasks in companies that also entail access to or the processing of personal data held by the company. According to the Federal Act on Data Protection (FADP), the processing of personal data can be transferred to a so-called processor. In this case, the company, as the so-called controller, remains responsible for ensuring that data protection is complied with. The company must ensure careful selection, appropriate instruction and necessary monitoring. The service provider has a reciprocal interest in delineating the duties transferred and clarifying which services are to be remunerated and how.

DPA – Data Privacy Agreement

In practice, the agreement on data processing (or order processing according to GDPR) has become established, often abbreviated as DPA. Instead of a separate DPA, data protection can also be regulated as an annex to the contract, as is common in the Anglo-American region with the so-called Data Privacy Addendum, or (also) DPA for short. More important than where, is that the responsibilities and obligations are regulated in accordance with the DPA or GDPR. Similar pitfalls present themselves time and again.

Important to regulate

The basic principle of both the FADP and the GDPR is to ensure that the processor only processes the transferred data in accordance with the instructions of the client. Suitable technical and organisational measures must be taken to ensure that the rights of the data subject are protected. Accordingly, in addition to the basic scope of the order, and thus the data processing, data security in particular must be determined. On the one hand, this should be appropriate to the risk and effective, and on the other hand, it must correspond to the state of the art. Depending on the sector, audits, pen tests and certifications may also be used for this purpose. 

In principle, the processor processes personal data for controller’s purposes, i.e. the company’s. As a service provider, processors therefore are not permitted to process this personal data for their own purposes – otherwise they would become controllers themselves (sometimes also referred to as a “joint controller”). For such a change of purpose, a processor must be able to assert its own justification, primarily the express consent of the data subject.

Pitfalls in DPA

The issue of subcontracting, i.e. the use of so-called subcontractors, is often forgotten or overlooked. These must be disclosed before the contract is concluded and must only be used after the contract has been concluded with the prior authorization of the company, i.e. the controller. In addition, when outsourcing abroad, there are also considerations regarding the disclosure of personal data abroad and data security in general (see also below on outsourcing with a US context).

As mentioned above, the company remains responsible as the controller. To this end, it may make sense to regulate support obligations with contractual agreements (e.g. obligations to cooperate) and/or to take specific organizational measures. This primarily concerns the rights of data subjects (information, rectification, erasure), but also instruments and obligations under the law (data protection violations, data protection impact assessments, etc.).

It is not uncommon for regulations on responsibility and liability as well as the resulting costs to be missing – or they are unilaterally transferred. It seems sensible to adapt liability to the dynamics of the service relationship, in particular how independently the service provider acts for the company. The costs in particular should be made transparent and are probably best orientated towards the polluter-pays principle. 

Outsourcing in a US context

If data is disclosed abroad during outsourcing, it must also be checked whether the countries in which the data is processed have an adequate level of data protection. This is primarily based on the decision of the Federal Council, i.e. the list of countries with an adequate level of data protection in accordance with the Swiss Data Protection Ordinance (DPO). If the service provider is located in a country that does not offer a level of data protection comparable to that in Switzerland, or if the data is processed in countries that do not offer an adequate level of protection compared to Switzerland, additional measures must be taken. Standard data protection clauses (also known as “Standard Contractual Clauses” SCC) are the first thing to consider.

The USA is therefore a special case. With the invalidation of the EU-US Privacy Shield – and subsequently the Swiss-US Privacy Shield – as a result of the Schrems II ruling by the European Court of Justice in July 2020, the processing of confidential data by a US provider in compliance with data protection regulations has become more complex. In the meantime, SCC was used as a workaround – without legal certainty as to whether this would be sufficient. Now the new Swiss-U.S. Data Privacy Framework for certified U.S. companies offers adequate protection for personal data. To this extent, the Federal Council has now put the USA back on the list of countries with an adequate level of data protection and will in future allow the transfer of personal data from Switzerland to certified companies in the USA without additional guarantees. The Federal Council has brought the corresponding amendment to the DPO into force on September 15, 2024.