Cloud Security Basel Novartis Campus — multi-cloud

Data residency

The FADP does not itself require data to be stored in Switzerland; cross-border transfers are permitted to countries the Federal Council has listed as providing adequate protection, and otherwise require safeguards such as standard contractual clauses. Practical residency pressure comes from sector law and buyer policy rather than the FADP: banking secrecy under Art. 47 of the Banking Act, FINMA Circular 2018/3 on outsourcing for banks, securities firms and insurers, and professional secrecy rules for healthcare and legal work.

What shapes cloud procurement here

Switzerland sits outside the EU: the compliance conversation starts from the revised FADP and the FDPIC rather than the GDPR, so a GDPR-only compliance package does not by itself answer Swiss buyer requirements, even though the two regimes are broadly aligned and the EU treats Switzerland as adequate. Swiss-only hosting is a common contractual demand in banking, insurance, healthcare and cantonal government work, driven by banking secrecy (Art. 47 Banking Act) and FINMA Circular 2018/3 outsourcing duties including audit and inspection rights that must survive into subcontractor chains; all four major hyperscalers now have Zurich regions, so this is satisfiable but constrains provider and service choice. Delivery language follows the region: German around Zurich, Basel and Bern, French in Geneva and Lausanne, with English standard inside engineering teams. Engineering salaries are among the highest in Europe and billing is in CHF, so buyers compare external rates against a very high internal cost baseline.

Sector regulators