Data protection and the blockchain
The revised Federal Act on Data Protection entered into force on 1 September 2023 and applies to the processing of personal data by private persons and federal bodies.1 A public blockchain can contain personal data, for example where addresses can be linked to identified persons or where personal information is recorded in transactions. The immutability of the blockchain conflicts with the rights of data subjects to have incorrect data corrected and to have their data deleted.
Swiss law has not resolved this conflict by specific rules. Practitioners advise projects to avoid recording personal data on public blockchains and to keep such data off the chain, with only a hash or a reference recorded on it. Crypto service providers that identify their clients under the Anti-Money Laundering Act process large amounts of personal data and are subject to the ordinary data protection rules for that processing. The European Union's General Data Protection Regulation may also apply to Swiss providers that serve clients in the Union, with requirements that are in some respects stricter than those of Swiss law.
Notes
- SECO SME portal, "New Federal Act on Data Protection (nFADP)", kmu.admin.ch: the revised FADP and the Data Protection Ordinance in force since 1 September 2023. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.