Right of Access (Auskunftsrecht) under revDSG
Auskunftsrecht is an employee's right to request all personal data your company holds about them—salary records, performance notes, emails, recruitment files. Under the revised Federal Data Protection Act (revDSG), which applies to all Swiss employers regardless of size, you must provide a clear, complete answer within 30 days of the request, free of charge. This right comes up when an employee leaves, suspects data misuse, or simply wants transparency. The most common mistake is refusing the request, delaying beyond 30 days, or providing incomplete information because you assume certain data is "confidential."
Auskunftsrecht (right of access) means an employee can demand in writing that you disclose every piece of personal data you store about them—including contact details, salary history, performance evaluations, medical information, recruitment notes, and communications.
This is not a request you can ignore. The revised Federal Data Protection Act (revDSG), in force since 1 September 2023, gives every person in Switzerland the right to know what data organisations hold about them.
When It Comes Up
An employee will typically request Auskunftsrecht in writing (email is acceptable) when they are leaving, questioning how their data is used, or preparing for a legal dispute. In smaller teams, this is rare—but it happens.
You may also receive requests from former employees, candidates who were rejected, or contract workers. The right applies to anyone whose personal data you process.
- Employee or former employee submits a written request for their personal data
- Candidate asks what information you kept after rejecting their application
- Person disputes accuracy of salary records or performance history
- Request triggers ahead of employment dispute or severance negotiation
- Data subject simply exercises their privacy right without stating a reason
Your Legal Obligation
You must respond within 30 calendar days with a complete, intelligible copy of all personal data you hold on that person. If the request is complex or you process large amounts of data, you can ask for an extension (but only once, and only for another 30 days).
You must provide the data free of charge. You cannot charge an admin fee, and you cannot demand a reason for the request. Information must be in a clear, commonly used format—digital copy is standard for employers.
- Provide all personal data you hold (recruitment files, contracts, emails, performance records, salary information, medical notes, communications)
- Answer within 30 days, starting from receipt of the written request
- Deliver in a clear, accessible format (PDF, spreadsheet, or printed)
- No fee or administrative charge is permitted under revDSG
- You may decline only if the request is manifestly unfounded or excessive
- Document your response and keep a record of the request
Most Common Mistake
Many employers assume that performance notes, medical information, or internal communications are "confidential" and refuse to disclose them. This is incorrect. Auskunftsrecht overrides internal confidentiality—if you hold the data, you must share it.
Other mistakes include ignoring the request, responding after 30 days, or providing incomplete files because you forget a folder or assume some data doesn't count. Missing emails or contract amendments will expose you to a complaint to your canton's data protection officer.
- Refusing disclosure because data feels 'internal' or sensitive—revDSG requires transparency
- Missing the 30-day deadline; delays trigger regulator complaints
- Providing only HR files but forgetting emails, project notes, or IT logs that also contain personal data
- Charging a fee for producing the data
- Demanding the employee explain why they want the information
- Redacting names of other employees without legal grounds
Frequently asked questions
- Can I refuse an Auskunftsrecht request?
- Rarely. You can decline only if the request is manifestly unfounded, repetitive, or abusive. If an employee submits one reasonable written request, you must answer. Consult a lawyer if you believe the request qualifies as excessive.
- Do I have to include other people's names in the data I provide?
- No. You may redact names of other employees, clients, or third parties—but only where disclosure would violate their privacy or confidentiality without a legal justification. Names in emails that directly concern the employee must be included.
- What if I don't store the data in one place?
- You are still responsible for gathering it. Email, file servers, paper records, messaging apps—if you hold personal data, you must compile and provide it. This is often why employers miss deadlines. Start early and check all systems.
General information for Swiss employers, not legal advice. Have a lawyer confirm anything with legal consequences.