Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

Switzerland Data protection Clear all filters

5cases from 1 jurisdiction

–Total of monetary amounts (0 cases with an amount)

–Largest single case

–Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by authority

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB) – 0 % · 4 cases
Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025 – 0 % · 1 case

What for?

by topic

Who?

by sector

All sectors

When?

per year, by date of decision

Trend
Period	Cases	Total
2024	1	–
2025	2	–
2026	2	–

5 cases

Newest first Highest amounts

22 Jun 2026 Inkasso-Team AGFederal Administrative Court upholds FDPIC: Inkasso-Team was not allowed to publish debtor data SwitzerlandData subject rights and transparency Order

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

What organisations can take from it

Publicly naming and shaming debtors cannot be justified under data protection law – debt collection must use less intrusive means.

Authority / court: Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSG Art. 6, Art. 19, Art. 31
Action: Order
Status of proceedings: final
Sector: Financial services and insurance
Published: 20 Aug 2026

Sources

Bundesverwaltungsgericht bestätigt Entscheid des EDÖB Press release of an authority
Urteil des Bundesverwaltungsgerichts A-3891/2025 vom 22. Juni 2026 Court decision

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

17 Apr 2026 Cream della Cream Switzerland GmbH und Philipp Plein International AGFDPIC ruling: Philipp Plein and Cream della Cream ignored objections to advertising SwitzerlandMarketing and consent Order

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

What organisations can take from it

An objection to advertising must take effect across all systems – a confirmed deletion followed by further advertising violates the principle of good faith.

Relevance to training and awareness

Handling objections to advertising and deletion requests

Authority / court: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law: Data protection · Marketing and consent
Legal basis: DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31
Action: Order
Status of proceedings: final
Sector: Retail and e-commerce
Published: 26 Jun 2026

Sources

Verfügung des EDÖB gegen Cream della Cream Switzerland GmbH und Philipp Plein International AG Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

16 May 2025 PostFinance AGEDÖB orders PostFinance to obtain explicit consent for voice recognition SwitzerlandData subject rights and transparency Order

PostFinance AG created voiceprints of its customers for authentication by voice recognition without obtaining their active consent; customers who did not want this had to object themselves. The Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB, Federal Data Protection and Information Commissioner) considered this processing of biometric data disproportionate and, by ruling of 16 May 2025, ordered PostFinance to obtain explicit consent in future and to delete voiceprints for which no such consent exists. PostFinance has appealed to the Federal Administrative Court.

What organisations can take from it

Biometric procedures need an active opt-in from the individuals concerned; a mere right to object is not enough.

Relevance to training and awareness

Biometric authentication and consent (opt-in instead of opt-out)

Authority / court: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Bundesgesetz über den Datenschutz (DSG): Grundsatz der Verhältnismässigkeit; biometrische Daten als besonders schützenswerte Personendaten, ausdrückliche Einwilligung
Action: Order
Status of proceedings: under appeal
Sector: Financial services and insurance
Published: 7 Aug 2025

Sources

EDÖB-Mitteilung vom 07.08.2025: EDÖB schliesst Untersuchung zur Stimmerkennung bei PostFinance ab Press release of an authority

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

29 Jan 2025 Cembra Money Bank AGFDPIC ruling: Cembra Money Bank answered access requests too late and in generic terms SwitzerlandData subject rights and transparency Order

From December 2023 to September 2024, Cembra answered 9 of 13 access requests after the 30-day deadline had expired, and responded to all 13 people only with standard letters instead of the data actually processed about them. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) required the bank to provide the data subsequently.

What organisations can take from it

Access requests need a process with resources and deadline monitoring – boilerplate text is no substitute for genuine disclosure of data.

Relevance to training and awareness

Handling access requests

Authority / court: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSG Art. 25 Abs. 2 lit. b, Art. 25 Abs. 7
Action: Order
Status of proceedings: final
Sector: Financial services and insurance
Published: 1 Jul 2025

Sources

Verfügung des EDÖB gegen die Cembra Money Bank AG Press release of an authority
Verfügung des EDÖB vom 29. Januar 2025 gegen Cembra Money Bank AG Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

1 May 2024 a Swiss IT service provider and two Swiss federal officesFDPIC: data protection infringements at IT service provider and two federal offices after ransomware attack SwitzerlandData processorsanonymised Other

Following the hacker attack on an IT service provider, the Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) found that personal data of two federal offices had reached the service provider via support processes without the necessary data protection safeguards. The service provider subsequently retained the data in breach of data protection law and partly in breach of contract.

What organisations can take from it

Real data does not belong in service providers' support and test environments – clients must control disclosure and deletion.

Relevance to training and awareness

Passing real data to service providers for support

Authority / court: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law: Data protection · Data processors
Legal basis: Datenschutzgesetz (DSG)
Action: Other
Status of proceedings: unknown
Sector: Telecoms, IT and software
Published: 1 May 2024

Sources

EDÖB, Medienmitteilungen (Übersicht) (Entscheidung 2024) Press release of an authority

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 May 2026 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source (company names until they are anonymised).

Company names are anonymised two years after the decision in a case, in line with the practice of many supervisory authorities. The official sources remain linked.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Ready for training that actually lands?