Residency Is Not Sovereignty
Switzerland made digital sovereignty a 2026 priority. What federal and cantonal rules actually require, sector by sector, and why data location is only the first question.
For CDOs, CIOs and heads of data governance in Switzerland
- Switzerland has defined digital sovereignty, made it a focus theme for 2026, and since 1 January 2026 requires the central federal administration to assess it in every relevant IT project.
- The federal definition is about control and the capacity to act, not independence. Where independence is unrealistic, the minimum is being able to verify how a digital resource works.
- Swiss law already sets very different sovereignty bars by sector: legal protection at the destination for personal data, Swiss storage under Swiss law for the electronic patient record, customer-held keys for sensitive cantonal data, detection and reporting for critical infrastructure. A data leader needs to know which bar applies to which data.
For your next steering committee: for each critical data domain, name the rule that sets its sovereignty bar, and the rung you have actually reached.
Ask where an organisation's data is, and you will usually get a confident answer: Zurich, Geneva, Frankfurt. Ask who can compel access to it, who holds the keys, and who could run the service next month if the provider walked away, and the answers become much less confident. Over the past year, the Swiss federal government has turned that second set of questions into policy. This briefing explains what it decided, what Swiss law already requires sector by sector, and what any data leader can borrow from it.
A Federal Priority, Built for the State First
On 26 November 2025, the Federal Council adopted its report on Switzerland's digital sovereignty, in response to postulate 22.4411 Z'graggen. It defines digital sovereignty as the control and capacity to act in the digital space that the State needs to perform its tasks.1 It also tasked the State Secretariat for Security Policy, working with the Directorate of International Law, with setting up an interdepartmental working group to keep that overview current.
Two weeks later, on 12 December 2025, the Federal Council adopted the Digital Switzerland Strategy 2026 with three focus themes: digital sovereignty, Switzerland as a digital host state, and the introduction of the e-ID.2 The same day it took note of new Federal Chancellery guidelines on sovereignty. Their binding form is directive W012, decided on 10 December 2025 and in force since 1 January 2026, which requires every relevant IT project of the central federal administration to assess and document digital sovereignty, with checkpoints built into the HERMES project method.3 On 20 October 2026, the Federal Office of Information Technology, Systems and Telecommunication published the tender for the Swiss Government Cloud, framed around flexibility, open standards and the operational autonomy of the administration.4
- Zurich approves Microsoft 365 for its cantonal administrationDecision under the cantonal information and data protection act, using the provider's Swiss data centres.
- Geneva voters adopt a right to digital integrityNew article 21A of the cantonal constitution, accepted by 94.21% of voters.
- Revised Federal Act on Data Protection in forceCross-border disclosure rules rest on a binding Federal Council list of adequate countries.
- FINMA Circular 2023/1 in forceOperational risks and resilience for banks, including a dedicated framework for critical data.
- Swiss-US Data Privacy Framework takes effectCertified US companies are added to the list of recipients with adequate protection.
- Critical infrastructure must report cyberattacks within 24 hoursAmended Information Security Act; fines for failure to report apply from 1 October 2025.
- Swiss Bankers Association Cloud Guidelines, third editionAligned with FINMA's new concepts of bank client data and critical data.
- Cantonal data protection commissioners adopt a cloud resolutionSensitive data in international SaaS only with encryption controlled by the public body.
- Federal Council report on digital sovereigntyDefines sovereignty as the control and capacity to act the State needs in the digital space.
- Digital Switzerland Strategy 2026Digital sovereignty becomes one of three focus themes for the year.
- Directive W012 in force for the federal administrationSovereignty must be assessed and documented from the start of every relevant IT project.
- Geneva's parliament votes a motion on cantonal digital sovereigntyMotion 3052 builds on the constitutional right to digital integrity.
- Swiss Government Cloud tender publishedBuilt around flexibility, open standards and operational autonomy.
Control, Not Independence
The most useful idea in the federal texts is a refusal. W012 does not ask the administration to be independent of foreign technology. It states that total independence is not realistic in most cases, and that the minimum is the capacity to control, meaning the ability to verify how a digital resource actually functions.3 That turns sovereignty from a yes-or-no question into a graded one.
The directive adds a principle of proportionality: the more a task depends on a digital resource, the higher the sovereignty requirements for that resource. It then gives two dimensions for the assessment. The first is a model of technology layers, from software down to raw materials. The second is a set of reference values: two overarching ones, independence and control on one side and cost and economic efficiency on the other, and four specific ones, namely resilience, data protection and information security, cooperation and standardisation, and innovation and suitability.3
The values are expected to pull against each other. Running a service in-house raises independence and cost at the same time. A global SaaS product raises innovation and lowers control. W012 does not resolve those tensions in advance. It asks project leaders to name them, place them in the right layer, and document the trade-off. For a data leader, that is a governance discipline, not a procurement preference.
One Country, Six Different Bars
There is no single Swiss sovereignty rule. There are several, written for different sectors at different times, and they put the bar in very different places. Six of them cover most of what a Swiss data leader will meet.
Legal protection at the destination
Under article 16 of the Federal Act on Data Protection, personal data may be disclosed abroad if the Federal Council has found that the destination offers adequate protection; otherwise specific safeguards are required. Since 15 September 2024, US companies certified under the Swiss-US Data Privacy Framework are on that list. The decision is reviewed regularly and can be revoked at any time.5
The bar: the law at the destination. Location as such is not required.
Swiss storage under Swiss law
Data in the electronic patient record, backups included, is stored encrypted in Switzerland by companies subject to Swiss law. These companies may not use the data for other purposes and cannot be compelled by a foreign authority to hand it over.6
The bar: location, jurisdiction and encryption at once. The most complete Swiss example.
Keys held by the customer
In November 2025 the conference of Swiss data protection commissioners concluded that outsourcing particularly sensitive personal data, or data under a legal duty of secrecy, to SaaS solutions of large international providers is inadmissible in most cases, unless the public body encrypts the data itself and the provider has no access to the keys.7 The resolution is not legally binding. Zurich's government had taken a different, risk-based route in 2022, approving Microsoft 365 for its administration through Swiss data centres, with data classification deciding what may go there.8
The bar: key control. Same country, two readings.
A fundamental right
Article 21A of the Geneva constitution protects digital integrity, including protection against abusive processing of data linked to a person's digital life, security in the digital space, a right to an offline life and a right to be forgotten. Voters accepted it in June 2023 with 94.21%. On 1 October 2026 the Grand Council voted motion 3052 on preserving the canton's digital sovereignty.9
The bar: a citizen's right in dealings with the State, still being translated into practice.
Knowing and reacting
Since 1 April 2025, operators of critical infrastructure, such as energy and drinking water suppliers, transport companies and cantonal administrations, must report cyberattacks to the Federal Office for Cyber Security within 24 hours of discovery. Fines of up to CHF 100,000 apply from 1 October 2025.10
The bar: operational control. You cannot report what your provider does not tell you.
Control and auditability
FINMA Circular 2023/1 requires banks to identify their critical data and manage its confidentiality, integrity and availability.11 The third edition of the Swiss Bankers Association Cloud Guidelines translates these duties into technical, organisational and contractual measures, including audit rights.12 FINMA's position is that responsibility for an outsourced function cannot be delegated.13
The bar: operational control and auditability, with growing attention to foreign providers.
Finance shows why the question is no longer theoretical. FINMA's Risk Monitor 2025 keeps outsourcing among its main risks and points to a growing dependence on a small number of central ICT providers, including for cloud and software as a service.13
Source: FINMA Risk Monitor 2025. Figures at 31 December 2023 and 31 December 2024.
The same report adds that geopolitical uncertainty must be taken into account when working with foreign providers, because political tension, regulatory change or sanctions can affect the availability or integrity of outsourced services.13 Sovereignty, in other words, has entered the supervisor's vocabulary without the word being used.
Residency Is the First Rung
Most sovereignty conversations stop at data residency. Read together, the Swiss rules above describe at least five distinct questions, each harder to answer than the one before. Location is the first rung, not the destination.
- Location.
Where the data and its backups physically sit. Test: can you name the data centres for production, backup and support access?
Rung 1 - Jurisdiction.
Which law governs the provider and who can compel it to disclose data. Test: do you know which foreign authorities could order your provider, or its parent company, to hand over your data?
Rung 2 - Key control.
Who holds the encryption keys, and whether the provider can read the data in clear. Test: could your provider decrypt your data without your involvement?
Rung 3 - Operational control.
Who runs, monitors and audits the service, and who learns first when something goes wrong. Test: would you know about an incident at your provider within hours, and can you audit it?
Rung 4 - Exit.
Whether you could move the service or take it back within a tolerable time. Test: is there a documented, tested path to export the data and run the service elsewhere?
Rung 5
- 1Location
- 2Jurisdiction
- 3Key control
- 4Operational control
- 5Exit
Editorial reading by DataEdgePro, not legal advice. "Not set by this rule" means the bar comes from elsewhere, if at all.
Two observations follow. First, no Swiss rule sets all five bars at once, so an organisation subject to several of them inherits the highest bar for each rung, domain by domain. Second, the rungs that matter most when something goes wrong, operational control and exit, are the ones least often written down.
Tick the statements that are true for your domain.
A Method Any Organisation Can Borrow
W012 was written for federal projects, but its procedure is generic. It runs in three steps.3
- Check whether sovereignty is at stake.
It is when the performance of a core task depends decisively on a digital resource. If it does not, a light record is enough.
- Assess along the two dimensions.
Identify the technology layers where sovereignty matters for this project, and the reference values that are relevant to it.
- Name the tensions and write the questions.
Turn the tensions into concrete questions for the design phase, and document the answers so the decision can be traced later.
The federal worked example is an AI application that extracts information from records and files it automatically. Its assessment focuses on two layers, the software itself and the platform it runs on, and on three values: independence and control, data protection, and cost. The questions it produces would fit any company: could we run the application ourselves or change provider if needed, what protection and retention requirements apply to the data, and how does more independence compare with the cost of running it in-house?3
Layer names and scope follow directive W012, which builds on the acatech study on digital sovereignty. Examples for organisations are DataEdgePro's.
What makes the method work is not the grid itself but where it sits. The Confederation placed it inside its standard project method, at defined checkpoints, with the project lead responsible and the sponsor required to take the results into decisions.3 A sovereignty assessment that lives in a separate policy document gets done once. One that sits in the project template gets done every time.
A Checklist for the Next Six Months
Making sovereignty a data governance practice
- Map each critical data domain to the rule that sets its sovereignty bar: FADP, the patient record law, cantonal law, FINMA, the ISA, or a client contract.
- For each domain, record the rung actually reached, based on evidence rather than on the provider's documentation.
- Know who holds the keys for your most sensitive data, and whether any provider can read it in clear.
- Document an exit path for every critical service: export format, time needed to switch, and who could run it.
- Include software as a service and sub-processors in the inventory, not only infrastructure.
- Add a sovereignty checkpoint to your project method, as the Confederation did with HERMES.
- Report gaps to the executive board with the trade-offs, such as cost against independence, stated explicitly.
If you cannot place your client or patient data on the ladder today, start there.
Sovereignty Is a Data Governance Discipline
The Swiss debate is often framed as a choice of provider: a hyperscaler or a Swiss cloud. The federal texts frame it differently, as a question of control that has to be assessed, documented and revisited, layer by layer and value by value. That is a data governance question before it is a procurement one. The organisations that will handle it well are those that already know which data is critical, who owns it, and which rule sets its bar.
Sources & references
- Federal Council, Digitale Souveränität der Schweiz, report in response to postulate 22.4411 Z'graggen, 26 November 2025, and press release of the same day. parlament.ch · admin.ch
- Federal Council, Federal Council adopts Digital Switzerland Strategy 2026, press release, 12 December 2025. admin.ch
- Federal Chancellery, Souveraineté numérique de l'administration fédérale, W012 version 1.0, decided 10 December 2025, in force 1 January 2026; and press release on the guidelines, 12 December 2025. bk.admin.ch · admin.ch
- Federal Office of Information Technology, Systems and Telecommunication, Swiss Government Cloud: tender procedure launched, press release, 20 October 2026. admin.ch
- Federal Act on Data Protection of 25 September 2020 (SR 235.1), art. 16; Federal Council, Swiss-US Data Privacy Framework: Certified US companies offer adequate protection for personal data, press release, 14 August 2024, in force 15 September 2024. fedlex.admin.ch · bj.admin.ch
- eHealth Suisse, Factsheet EPD Datensicherheit, measure T2, with reference to the ordinance on the electronic patient record (EPDV) and its technical and organisational certification requirements. e-health-suisse.ch
- privatim, Conference of Swiss Data Protection Commissioners, Resolution zur Auslagerung von Datenbearbeitungen in die Cloud, November 2025. fr.ch
- Government Council of the Canton of Zurich, RRB 542/2022, Einsatz von Cloud-Lösungen in der kantonalen Verwaltung (Microsoft 365), Zulassung, 30 March 2022; and answer to parliamentary question, RRB 560/2025, 21 May 2025. zh.ch
- Constitution of the Republic and Canton of Geneva, art. 21A; Grand Council, petition report P 2235-C (vote result of 18 June 2023); motion M 3052 for preserving the digital sovereignty of the Canton of Geneva, voted 1 October 2026. unige.ch · ge.ch · ge.ch
- Federal Office for Cyber Security, Merkblatt zur Meldepflicht für Cyberangriffe auf kritische Infrastrukturen; Information Security Act (ISA) as amended, in force 1 April 2025; sanctions from 1 October 2025. ncsc.admin.ch
- FINMA, Circular 2023/1 "Operational risks and resilience – banks", in force 1 January 2024, chapter IV.D on critical data. finma.ch
- Swiss Bankers Association, Cloud Guidelines, third edition, November 2025. swissbanking.ch
- FINMA, Risikomonitor 2025, 17 November 2025, chapters on outsourcing and cyber risks, including the chart on material outsourcings to public cloud service providers. finma.ch
