Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
Cross Border Disclosure and Duty to Inform

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) FADP-10: Cross-Border Disclosure (Articles 16-18)

Conditions for disclosing personal data abroad including adequacy and safeguards

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 70 controls across 53 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-14 Direct Marketing

Armenia Law on Protection of Personal Data (2015) · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-8 APP 8 - Cross-border disclosure of personal information

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S4 Targeting and Communication

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-12 Article 13 - Cross-border transfer

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-17 Section 24 - Appropriate Safeguards

Family Educational Rights and Privacy Act (FERPA) · 1 control

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.22_23_24 Cross-border data transfers (UAE PDPL Articles 22-24)

GDPR · 1 control

  • GDPR-Art.45 Transfers on the basis of an adequacy decision

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-25 Supervisory Cooperation and Coordination

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

Indiana Consumer Data Protection Act · 1 control

  • INCDPA-Processor-Contracts-DPA-Subprocessor-Audit-Confidentiality-EndOfContract Indiana CDPA Processor Contracts - Data Processing Agreement (DPA) + Required Provisions + Subprocessor Approval + Confidentiality + End of Contract Deletion + Audit Rights + Assistance

Iowa Consumer Data Protection Act · 1 control

Israel Protection of Privacy Law (5741-1981) · 1 control

  • IsraelPPL-CrossBorder-Transfer-Sec36-EU-Adequacy-Israel-Adequacy-SCCs-Reciprocity-Foreign-Recipient Israel POPL Cross-Border Transfer + Section 36 + Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001 + EU Adequacy Decision (2011) + SCCs + Foreign Recipient Obligations + Reciprocity

Jamaica Data Protection Act 2020 · 1 control

Kentucky Consumer Data Protection Act · 1 control

LGPD · 1 control

  • LGPD-BR-Cross-Border-International-Transfer-Article-33-Adequacy-SCC-BCR-ANPD-Approval-Mercosur-RIPD Brazil LGPD Cross-Border + Article 33 + Adequacy + SCC + BCR + Mercosur + RIPD

Liechtenstein DPA · 1 control

MTCS (Singapore) · 1 control

  • MTCS-Scope-SS-584-Singapore-Standards-Council-IMDA-SAC-3-Tier-2013-2015-2020-2024-Certification MTCS Scope + SS 584 + Singapore Standards Council + IMDA + SAC + 3-Tier Framework + Certification

Malaysia PDPA 2010 · 1 control

  • MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

  • MU-DPA-Enforcement-Commissioner-Section-41-43-MUR-200K-5-Year-Prison-ICT-Appeal-Tribunal-Supreme-Court Mauritius DPA Enforcement + Commissioner + Section 41 + Section 43 + MUR 200K + 5 Year Prison + ICT Appeal Tribunal + Supreme Court

Mexico LFPDPPP · 1 control

  • MX-LFPDPPP-Enforcement-INAI-Articles-63-64-67-320K-Days-Minimum-Wage-3-Year-Prison-TFJA-Recurso-Revision-SCJN Mexico LFPDPPP Enforcement + INAI + Articles 63-64-67 + 320K Days Minimum Wage + 3 Year Prison + TFJA + Recurso de Revision + SCJN

Minnesota Consumer Data Privacy Act · 1 control

  • MN-CDPA-Processor-Contract-Security-Section-325O-08-Pseudonymisation-Section-325O-09-De-Identification Minnesota CDPA Processor + Section 325O.08 + Security + Pseudonymisation + Section 325O.09 + De-Identification

Montana Consumer Data Privacy Act · 1 control

  • MT-CDPA-Processor-Contract-Security-MCA-30-14-2809-30-14-2811-Pseudonymisation-De-Identification Montana CDPA Processor + MCA 30-14-2809 + Security + Pseudonymisation + MCA 30-14-2811 + De-Identification

NIST SP 800-122 · 1 control

  • NISTSP122-7 PII Sharing, Cross-Border Transfers, and Third-Party Agreements

New Hampshire Data Privacy Act · 1 control

  • NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 1 control

  • NJDPA-7 Data Protection Assessments and Processor Contracts

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-3 Personnel Security, Physical Security, and Cryptography

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-7 Cross-Border Transfer of Personal Data under NDPR Section 2.7-CBT

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs

PDPA Singapore · 1 control

  • PDPASG-6 Transfer Limitation, Cross-Border Safeguards, and Data Intermediary Oversight

PDPA Thailand · 1 control

  • PDPATH-6 Cross-Border Transfer and Processor Engagement

POPIA · 1 control

  • POPIASA-6 Transborder Information Flows, Direct Marketing

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-6 International Transfers and Processor Agreements

Privacy Act 2020 · 1 control

  • NZPRV-5 IPP 11-12 Disclosure, Cross-Border Disclosure (Schedule 8)

Qatar DPL · 1 control

  • QATAR-6 Cross-Border Transfer and Processor Management

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

  • RCEPEC-2 Cross-Border Transfer, Computing Facilities, Localization (12.14-15)

Saudi Arabia PDPL · 1 control

  • SA-PDPL-24 Cross-border transfer safeguards

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-CLD.4 Cloud Data Sovereignty

South Korea ISMS-P · 1 control

  • ISMSP-PI-04 Cross-Border Transfer

South Korea PIPA · 1 control

  • PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021

Taiwan PDPA · 1 control

  • TAIWAN-4 DPIA, Privacy by Design

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

Turkey KVKK · 1 control

  • TURKEYKVKK-3 Special Categories and Sensitive Data

UK Data Protection Act 2018 · 1 control

  • UK-DPA18-LE-03 International Transfers (Law Enforcement)

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-3 Controller and Processor (Articles 24-43)

Uruguay DPL · 1 control

  • URUGUAY-5 Database Registration with AGESIC URCDP

Vietnam PDPD · 1 control

  • VIETNAMPDP-3 Data Subject Rights

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-4 Privacy Notice and DPIA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Cross Border Disclosure and Duty to Inform

Query this from an agent

The graph holds this control, the 70 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) controls