Yes, but two conditions must both be true, and the first one says nothing about the United States.
The first is Article 9 paragraph 1 letter b FADP: processing may be assigned to a third party only if «no statutory or contractual duty of confidentiality prohibits assignment». That question comes before any thought about the country, and for many fiduciary mandates the answer is written in the mandate itself.
The second is Article 16 FADP: personal data may be disclosed abroad if the Federal Council has decided that the protection there is adequate. For the United States it has — but only towards certified companies under the Swiss–US Data Privacy Framework, since 15 September 2024. If the provider is not certified, that basis is missing and you need one of the guarantees of Art. 16 para. 2 or an exception under Art. 17.
The question that comes before the country
The reflex is to ask where the servers are. Swiss law asks in a different order. Art. 9 para. 1 FADP (SR 235.1) reads:
«The processing of personal data may be assigned by contract or by the legislation to a processor if: a. the data is processed only in the manner in which the controller itself is permitted to do it; and b. no statutory or contractual duty of confidentiality prohibits assignment.»
Two words do the work: statutory or contractual. The article draws no distinction. A confidentiality duty that comes from a clause in the mandate weighs, at this step, as much as one that comes from a statute.
If the person uploading is a lawyer, a notary or an auditor bound to confidentiality under the Code of Obligations, the statutory duty exists and has a name: Art. 321 of the Criminal Code (SR 311.0), which makes disclosing professional secrets an offence — on complaint, with a custodial sentence not exceeding three years or a monetary penalty. The list in Art. 321 no. 1 is closed: clergy, lawyers, defence lawyers, notaries, patent attorneys, auditors subject to a duty of confidentiality under the Code of Obligations, and the health professions.
If the person uploading is a fiduciary firm in the ordinary sense — bookkeeping, tax returns, tax advice, administration — something must be said that a lot of sales material avoids: Art. 321 of the Criminal Code does not name it. Telling a fiduciary that «professional secrecy obliges you to go on-premise» attributes to them a criminal provision that does not apply to them.
That is not a loophole; it is a shift, and it moves towards the firm. Outside the criminal list, the fiduciary firm remains the controller under the FADP — the one who «determines the purpose and the means of processing personal data» (Art. 5 let. j) — and Art. 9 para. 2 requires that it «must satisfy itself in particular that the processor is able to guarantee data security». Its mandate remains: if there is a confidentiality clause, the duty is contractual and Art. 9 gives it no discount. And Art. 162 of the Criminal Code remains, covering «any person who betrays a manufacturing or trade secret that they are under a statutory or contractual duty […] not to reveal» — and a company's books are where its trade secrets live.
Where the answer is written, then. In two contracts: the one signed with the client and the one signed with the service provider. The question to bring to the next meeting is a single one: does the confidentiality clause of this mandate allow the processing to be assigned to a third party? If the answer is no, or there is no written answer, the question of the United States does not arise yet.
The country: Art. 16, and why the United States is only half in
Once the first step is cleared, the second follows. Art. 16 para. 1 FADP:
«Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection.»
For the United States that decision exists, and this is where the answer changes. The Federal Data Protection and Information Commissioner announced it on 15 August 2024:
«From 15 September 2024, this will ensure adequate data protection in the exchange of personal data between Switzerland and certified US companies.»
— FDPIC, 15.08.2024
Certified. Not «American»: certified under the Swiss–US framework. Adequate protection is not a property of the country; it is a property of the company that has signed up. The check is short — the list of certified companies is public — with two caveats:
- certification is per legal entity, and the name on the contract is not always the one you look up in the list;
- certification can be withdrawn or lapse: it is a status, not a certificate on the wall.
If the provider is not certified, what is left are the guarantees of Art. 16 para. 2: a treaty under international law; contract clauses notice of which has been given to the FDPIC beforehand; specific guarantees; standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; binding corporate rules approved in advance. The word that keeps coming back is beforehand: these are paths you take before uploading, not after.
The exceptions in Art. 17, and why consent is narrower than it looks
Art. 17 para. 1 FADP lists the cases in which data may be disclosed abroad by way of derogation from Art. 16. The first is the obvious one: «a. The data subject has explicitly consented to disclosure.» In a firm, three things narrow it.
Whose consent. A set of accounts holds more than the client's data: there are employees, suppliers, debtors. The consent of the person signing the mandate is the consent of one data subject, not of all.
«Explicitly». A line at the bottom of the terms and conditions is not ground on which to build a process that will repeat every day for years.
Consent under Art. 17 FADP is not consent under Art. 321 of the Criminal Code. Art. 321 no. 2 provides that the person is not liable «if they do so with the consent of the person to whom the information pertains or on the basis of written authorisation issued in response to their request by a superior authority or supervisory authority». For those on the list, consent to the transfer and consent to the disclosure must be handled separately.
The other letters of Art. 17 para. 1 — contract, overriding public interest, legal claims before a court, life and physical integrity, data made generally accessible, public registers — are written for specific situations. None is written for «using an IT service».
What we cannot promise you
We are not telling you the cloud is illegal. It is not: both conditions on this page can be met, and many firms meet them.
We are not telling you that a machine in the office fixes everything on its own. A local machine takes Art. 16 out of play — there is no disclosure abroad — and simplifies Art. 9, because there is no external processor. It does not exempt you from the other FADP duties: data security, information, records of processing activities, rights of data subjects. They all remain, and they remain yours.
We are not telling you that Art. 321 of the Criminal Code binds you if you are a fiduciary firm. Your duty, if there is one, is in the mandate.
We are not your legal advisers. This page cites the articles so that you can open them with your lawyer or auditor. It does not replace an assessment of your case.
The question to ask today
Open the mandate of your largest client and find the confidentiality clause. Does it allow the processing to be assigned to a third party? That line decides more than any comparison between providers.
If the answer is no — or if you would rather not have to look for it with every new mandate: with AG Core the AI runs on a machine in your office, the processing never leaves the firm and the question of the United States does not arise. We will show it to you live, on your own document types.
Or message us on WhatsApp +41 79 863 37 88 or call +41 91 814 86 00.
The English wording of Swiss federal law quoted here is the Federal Chancellery's translation on Fedlex; it has no legal force — the German, French and Italian texts are authoritative.
Sources
FADP (SR 235.1), Art. 5, 9, 16, 17 — Fedlex, status as of 1 September 2023 ·
Swiss Criminal Code (SR 311.0), Art. 162 and 321 — Fedlex, status as of 1 January 2026 ·
FDPIC — New Swiss-US Data Privacy Framework, 15.08.2024
All sources reopened on 31.10.2026.