← FFCheckWho do I contact?DE
Privacy · Switzerland
Updated September 2026

🔐 A company leaked or misuses my data — who do I report it to?

Direct answer

Under the GDPR you can demand from any company what it holds on you, correction and deletion, and it must answer within a month. Write to the company's data protection officer first. If it ignores you, misuses your data or lost it in a breach, complain to EDÖB — Eidg. Datenschutz- und Öffentlichkeitsbeauftragter (+41 58 462 43 95) — the data protection authority in Switzerland; it investigates and fines, free of charge. Identity misuse after a leak: also the police, Kantonspolizei — Suisse ePolice (suisse-epolice.ch), and your bank.

Call firstEDÖB — Eidg. Datenschutz- und Öffentlichkeitsbeauftragter
Report toKantonspolizei — Suisse ePolice
If that failsStiftung für Konsumentenschutz (SKS)

🗣️ What to say

"Under Article 15 GDPR I request a copy of all personal data you hold on me, its sources and recipients, within one month. Under Article 17 I request deletion of [what]. Please confirm in writing."

🪜 Step by step

  1. Write to the companyAccess request (Art. 15), deletion (Art. 17) or objection (Art. 21). One month to answer; keep the date.
  2. Collect proofThe e-mails, the breach notification, screenshots of the misuse, unsolicited calls or mails that show your data was passed on.
  3. Complain to EDÖB — Eidg. Datenschutz- und ÖffentlichkeitsbeauftragterOnline form. Attach your request and the non-answer. The authority contacts the company and can order and fine.
  4. Identity misuse: Kantonspolizei — Suisse ePoliceIf someone opened accounts or bought in your name after a leak, report it to the police and tell your bank.
  5. DamagesGDPR gives a right to compensation for material and non-material damage; consumer organisations run collective claims after large breaches.

📇 All contacts

EDÖB — Eidg. Datenschutz- und ÖffentlichkeitsbeauftragterSupervision, reporting of breachesWhen the company does not answer or misuses data📞 +41 58 462 43 95🔗 www.edoeb.admin.ch
Kantonspolizei — Suisse ePoliceReport identity misuseWhen someone acted in your name🔗 www.suisse-epolice.ch
Stiftung für Konsumentenschutz (SKS)Template letters for access and deletionFor the request to the company🔗 www.konsumentenschutz.ch

❓ Frequently asked

The company says it needs my data for "legitimate interest"

You can object (Art. 21); for direct marketing the objection is absolute — they must stop.

How long does the authority take?

Months, sometimes longer; but a complaint on file is what forces the company to answer, and fines follow patterns of complaints.

I keep getting spam calls

Register on the national do-not-call list where it exists, object to the caller in writing, and report the number to EDÖB — Eidg. Datenschutz- und Öffentlichkeitsbeauftragter.

📎 Sources

Last checked: 2026-09-26

🔎 Common searches

Recognise your own search? The answer above covers all of these.

  • “report data breach Switzerland”
  • “data protection authority Switzerland”
  • “GDPR complaint company”
  • “company won't delete my data”
  • “identity theft after data leak”

🧭 Is this still correct?

We check this information carefully, but phone numbers, websites and rules change — and sometimes we get something wrong. Spotted a mistake or a change? Let us know below.

🔗 Related questions

💳Scammed online→🆔Identity theft→

Your tools for Switzerland

Before it goes wrongCan I?What is allowed, what is not, which permit you need — with the official source.Energy · SwitzerlandElectricity & gasThe rules that protect you as an electricity and gas customer in Switzerland, and who to contact. Every fact is checked on an official source.Recognise it firstIs dit veilig?Check a phone number, website or message against 47,000 scam dossiers.