CHATGPT AT WORK · FADP · DATA PROTECTION
Your team is already pasting work text into AI tools. The real question is whether your rules have caught up - and Swiss regulators clearly think they have not.
Yes - but the Federal Data Protection Act (FADP) applies directly to AI tools, and the FDPIC and NCSC ran a joint campaign in October 2026 precisely because workplace use is outpacing company rules. The short version: no personal data of customers, patients or employees into public AI tools without a legal basis and proper safeguards.
What the law says
The FADP is technology-neutral: it applies to AI-supported processing like any other processing. In practice, per the FDPIC:
Transparency: people must know when they are dealing with a machine, and what happens to the data they enter - including whether it is used to train models.
High-risk processing (large-scale sensitive data, profiling) requires a data protection impact assessment.
Automated individual decisions about people carry specific rights: a person can ask for a human review.
Some uses are off-limits entirely: the FDPIC names real-time comprehensive facial recognition and social scoring as prohibited under data protection law.
The October 2026 joint campaign
For Cyber Security Month 2026, the FDPIC and the NCSC published joint guidance on generative AI at work. Their core warning: when staff paste text into an AI tool, they disclose more than they realise - and in a professional context that is often third-party data (customers, patients, employees) protected by the FADP.
The practical rules for a Swiss company
Decide which tools are approved, and use business tiers with training-on-your-data switched off.
Write down what may never be pasted: client data, HR data, contracts, unpublished financials, source code with secrets.
For anything high-risk, run the impact assessment the FADP requires.
Tell people when AI is involved in decisions about them.
Only 34% of Swiss SMEs currently have clear rules on what data employees may enter into AI tools (AXA/Sotomo 2026) - which means most Swiss workplaces are improvising on this today.
The takeaway: the law already applies to every AI prompt your team types. The only choice is whether you wrote the rules down.
Sources
FDPIC, "AI and data protection" (24 September 2025)
FDPIC & NCSC, "Generative AI in the workplace: Data Protection Challenges" (16 October 2026)
SECO, "AI gains ground among Swiss SMEs" (5 November 2025)
Last updated: 20 October 2026.
TL;DR: Employees can use ChatGPT at work in Switzerland, but the FADP applies to every prompt. No customer, patient or employee personal data into public AI tools without a legal basis. Approve tools, write a never-paste list, run impact assessments for high-risk use, and tell people when AI is involved in decisions about them. Only 34% of Swiss SMEs have these rules written down.
Reading time: ~3 min
Need a hand turning this into a one-page policy for your team? That is what we do. Discuss a project: eli5a.com/contact
