AI data protection in Switzerland: what rights do you have and how do you use them?
When an AI service processes your personal data, the usual law applies: according to the Federal Data Protection and Information Commissioner (FDPIC, page of 24 September 2025), the Federal Act on Data Protection (FADP) applies directly to AI-based data processing. You can ask for access to your data (art. 25 FADP), for correction and, under conditions, for deletion; the answer to an access request is due, as a rule, within 30 days (art. 25 para. 7 FADP). If it does not come, you can file a complaint with the FDPIC or go to the civil court.
Rappn compares the current promotions of 7 Swiss retailers, updated daily: free, no subscription.
See this week’s promotions in Rappn, freeAccording to the Federal Data Protection and Information Commissioner (FDPIC), the Federal Act on Data Protection (FADP) applies directly to AI-based data processing. You can ask whoever processes your data which data it holds about you (right of access, art. 25 FADP), have it corrected and, under conditions, deleted; the answer is due, as a rule, within 30 days (art. 25 para. 7 FADP).
Updated October 2026. Sources: FDPIC, “Knowing and asserting my rights” (undated) and “AI and data protection” (24 September 2025); Federal Act on Data Protection (FADP), SR 235.1 (status 7 July 2025); Data Protection Ordinance (DPO), SR 235.11 (status 1 December 2025), English texts for information only; GDPR, art. 3 (viewed on 20 October 2026).
What rights do you have when an AI processes your data?
The same as for any other processing of personal data. According to the FDPIC, whoever develops, offers or uses AI systems must make purpose, functioning and data sources transparent, and people who talk to a language model have a right to know whether the data they enter is used to improve the programmes or for other purposes. Requests go to the controller, the party that decides the purpose and means of processing (art. 5 lit. j FADP). What not to type into an AI: ChatGPT and personal data; questions to ask before installing an app.
This is the Rappn home screen with the current promotions of seven Swiss retailers, updated daily: tap the tabs to see what the app shows.
See this week’s promotions in Rappn, freeFree, no subscription · iOS & Android
Offers
What rights does the Swiss data protection act give you?
| Right | What you can ask for | Legal basis |
|---|---|---|
| Access (right to information) | Which data are processed, purpose, retention period, source, recipients, automated decisions and their logic | Arts. 25 and 26 FADP; DPO arts. 16 to 19 |
| Correction | Correction of incorrect data | Art. 32 para. 1 FADP |
| Objection | Saying that you do not want a processing: per the FDPIC, the controller stops it or explains why it may continue | Art. 30 para. 2 lit. b and art. 31 para. 1 FADP |
| Deletion | Deletion of the data, for example when no longer needed or when you withdraw consent | Art. 6 para. 4 and art. 32 para. 2 lit. c FADP |
| Data portability | The data you disclosed, in a common electronic format, or their transfer to another controller (automated processing, with consent or contract) | Arts. 28 and 29 FADP; DPO arts. 20 to 22 |
| Automated decisions | Information, stating your point of view, review by a natural person | Art. 21 FADP |
On model training (October 2026): ChatGPT and Claude offer a setting.
The EU GDPR does not apply directly in Switzerland (FDPIC), but it can apply in addition to the FADP if the processing takes place in the context of the activities of an establishment of the service operator in the EU (art. 3 para. 1 GDPR).
Automated decisions: when can you ask for a person?
When a decision is based exclusively on automated processing and has a legal consequence for you or a considerable adverse effect on you, the controller must inform you; on request you can state your point of view and ask a natural person to review the decision (art. 21 paras. 1 and 2 FADP, with exceptions).
How do you ask for access or deletion, step by step?
- Find the controller. It must tell you its identity and contact details, the purpose, any recipients and, for disclosure abroad, the State and safeguards (art. 19 FADP): the privacy policy usually does; for budget apps: how to read it. If an assistant is connected to other apps (ChatGPT connectors, Claude connectors, MCP server), write to each controller.
- Write by letter or email (DPO art. 16), with the text below or the FDPIC’s sample letters, and keep a copy and the date of sending; no reason is needed for access. The controller must verify your identity and you must cooperate.
- Wait 30 days for access. If it cannot answer in time, the controller must tell you how long it will take; if it refuses, restricts or delays the information, it must say so within the same period, with the reason (DPO art. 18; FADP art. 26 para. 4). Access is free; for disproportionate effort it may ask for at most CHF 300 (DPO art. 19). For correction or deletion the suitable period depends on the case, according to the FDPIC.
Please tell me whether personal data about me is processed and send me the information under art. 25 FADP: data, purpose, retention period, source, recipients (also abroad) and automated decisions with their logic. Is my content used to train models? My account: [email]. Answer expected within 30 days. [Name and date]
A general example with no guarantee of outcome; for other rights add what you ask for.
What if they do not answer?
If no answer arrives within a reasonable time, you can file a complaint with the FDPIC. It opens an investigation if there are sufficient indications of a significant violation (art. 49 paras. 1 and 2 FADP), but it does not enforce your rights for you and you are not a party (art. 52 para. 2). Against a private company there is also a civil action (art. 32 para. 2 FADP): according to the FDPIC it starts with an application for conciliation and no court costs are charged, but legal fees can still arise. General information, not legal advice.
How can you use these rights today?
First step, today: find the address for data requests in the privacy policy of an AI app you use. Rappn is a free Swiss app (iOS and Android) that compares the current promotions of seven Swiss retailers and turns receipts into a spending overview. In its privacy policy (version 2.0, 17 April 2026) it lists the rights of users, including a copy of the data, correction and deletion, and names info@rappn.ch for requests, aiming to answer within 30 days. Rappn covers groceries, not rent, insurance or taxes. Rappn is building an AI assistant for groceries: you can join the waitlist.
Updated: .
Why Rappn?
Rappn is an independent grocery price comparison app in Switzerland, with no commercial agreements with any retailer. Our comparisons are truly independent.
- 100% free: no subscription, no hidden costs
- Neutral: no commercial agreements with Migros, Coop, Aldi, Lidl, Denner, Aligro, or Otto’s
- Updated daily, as soon as the chains publish their deals
- The chains’ deals in one place: search, filter, compare, no subscription
- Meal planner in the Kitchen tab: plan the week, send the ingredients to your list
Ready to save on groceries?
Install Rappn and compare for yourself this week. No account required.Scan the code, install Rappn and compare current offers. No account needed.
Frequently Asked Questions
Does Swiss data protection law apply to AI too?
Yes, according to the FDPIC (page of 24 September 2025, already in its update of 8 May 2025): the FADP, in force since 1 September 2023, is technology-neutral and applies directly to AI-based data processing. It applies to circumstances that have an effect in Switzerland, even if they were initiated abroad (art. 3 para. 1 FADP).
Can I ask a company which data its AI uses?
Yes, with the right of access (art. 25 FADP): you can ask whether the company processes data about you and receive the data itself, with purpose, retention period, source and recipients, also abroad. According to the FDPIC, people who talk to a language model also have a right to know whether the data they enter is used to improve the programmes. Access is as a rule free and due within 30 days (art. 25 paras. 6 and 7 FADP; DPO art. 18).
Can I have my data deleted?
You can ask the controller, for example when the data is no longer needed for its purpose or when you withdraw consent (art. 6 para. 4 and art. 32 para. 2 lit. c FADP, according to the FDPIC). The right is not absolute: the controller may refuse if it has a ground of justification, such as a legal obligation or an overriding interest.
What can I do if an AI decides instead of a person?
If a decision is based exclusively on automated processing and has a legal consequence for you or a considerable adverse effect on you, the controller must inform you; on request you can state your point of view and ask a natural person to review the decision (art. 21 paras. 1 and 2 FADP). This does not apply if the decision is connected with a contract and your request is granted, or if you explicitly consented (art. 21 para. 3).
How does Rappn treat data?
Rappn GmbH is the controller: in its privacy policy (version 2.0, 17 April 2026) it lists the rights of users, including a copy of the data, correction and deletion, and names info@rappn.ch for requests, aiming to answer within 30 days. For which data it processes and why, read the full policy. Rappn is building an AI assistant for groceries: you can join the waitlist.