Your data rights: asking what a company or office knows about you

Last checked: 11 Oct 2026. Unofficial student guide, not EPFL or government advice: confirm on the linked official pages before you act. Unfamiliar abbreviation? See the Glossary.

Under the revised Federal Act on Data Protection (loi fédérale sur la protection des données, LPD / nLPD, in English FADP), in force since 1 Sep 2023, you can ask any company or federal body whether it processes your personal data and get a copy, usually free and within 30 days. This page explains how, and where to complain. For suspicious messages asking for your data, see Phishing, SMS and parcel scams.

Key facts

• Right of access: anyone can ask a data controller whether personal data about them is processed (LPD art. 25).
• Free: the controller provides the information free of charge (LPD art. 25 al. 6). Exception: if it takes disproportionate effort, you can be asked to contribute, up to CHF 300, and you are told the amount first (OPDo art. 19).
• 30 days: the information is given within 30 days of receiving the request; if not possible, the controller must tell you the new deadline (OPDo art. 18).
• No reason needed for your request (FDPIC, Droit d'accès).
• Cantonal and communal offices in Vaud are covered by Vaud law and the cantonal authority, not the FDPIC (FDPIC; Vaud APDI).

1. What you get

You receive at least (LPD art. 25 al. 2):

• who the controller is and how to contact them;
• the personal data itself;
• the purpose of the processing;
• how long the data is kept, or the criteria for deciding;
• where the data came from, if not from you;
• whether an automated individual decision is made, and its logic;
• who receives the data, including the country if abroad.

You cannot give up this right in advance (LPD art. 25 al. 5). Access can be refused, restricted or delayed in some cases, for example if overriding interests oppose it; the controller must then tell you why (FDPIC).

2. How to ask

• In writing. An oral request is possible only if the controller agrees (OPDo art. 16).
• By email or web form is fine if the controller identifies you properly; by post, add a copy of an official ID. You can black out data not needed to identify you (height, photo, document number), but keep your name and date of birth readable (FDPIC).
• Use the template: the FDPIC offers a model letter (lettre modèle droit d'accès) on its right of access page.
• Look for the contact address in the company's privacy policy (déclaration de protection des données); many have a data protection adviser (FDPIC, Dénonciation).
• No answer after 30 days? The FDPIC suggests sending a registered letter. For urgent requests or when you need proof, sign by hand and send by registered post (FDPIC).

3. Correction and deletion

• You can demand that inaccurate data be corrected, except where a law forbids the change or the data is archived in the public interest (LPD art. 32 al. 1).
• You can ask a court to ban a processing or a disclosure, or order the deletion or destruction of data (LPD art. 32 al. 2).
• The FDPIC page says you can ask for deletion or correction "if necessary" and offers model letters for this too (FDPIC).
• To verify: whether a company must delete data on a simple request outside court, in a given case; ask an advice service (see Free legal advice for students).

4. Complaints to the FDPIC (companies and federal bodies)

The Federal Data Protection and Information Commissioner (Préposé fédéral à la protection des données et à la transparence, PFPDT; FDPIC) can open an investigation against a federal body or a private person (LPD art. 49).

• Contact the controller first. The FDPIC asks you to do so before reporting, and does not follow up vague or incomplete reports (FDPIC, Dénonciation).
• It acts only on facts that point to a serious breach of the LPD. You have no right to an intervention and are not a party to any procedure (FDPIC).
• Do not send an ID copy with a report; the FDPIC will ask if needed (FDPIC).
• Online forms exist for people affected and for third parties (anonymous reports possible) (FDPIC, Dénonciation).
• Reporting a problem to the FDPIC is not among the services the FDPIC may charge private persons for (LPD art. 59).

5. Vaud public bodies: the cantonal authority

For the canton, communes and bodies doing public tasks for them, Vaud's own law applies (LPrD, BLV 172.65). The Autorité de protection des données et de droit à l'information (APDI) is an independent authority that informs anyone about their rights (vd.ch/apdi).

• Rue Caroline 2, Case postale 124, 1001 Lausanne; info.ppdi@vd.ch
• Phone help: Monday to Friday, 9:00 to 11:30, +41 21 316 40 64 (vd.ch).
• Vaud cantonal bodies (LPrD): you may see your data at any time and must prove your identity; no particular form is required; the answer is due within 30 days; access is in principle free, but a fee may be charged for substantial work, repeated requests or copies (LPrD, BLV 172.65, art. 25, 26 and 26a).

6. EPFL

EPFL is a federal body, so the LPD applies. Its Data Protection Officer (délégué·e à la protection des données, DPO) is the contact point for questions about how your data is processed and how to use your rights (EPFL, DPO).

• EPFL members: use the request form (EPFL login); others: email dpo@epfl.ch (EPFL, Rights of the individual).
• Postal address: EPFL, P-EM-DPO, BS 248, Station 4, 1015 Lausanne (EPFL, DPO).