Local LLMs or ChatGPT? A data-protection checklist for Swiss SMEs
What happens to your data in cloud AI tools, what the Swiss nDSG requires, and when a local or Swiss-hosted LLM is the better choice.
Generative AI saves time on writing, summarising and searching. But as soon as employees paste client data, contracts or internal documents into a public chatbot, the question arises: where does that data go, and is that allowed?
What happens to your data in cloud AI
With cloud AI services, prompts and uploaded files are processed on the provider’s servers, often outside Switzerland. Depending on the product and contract, data may be stored, reviewed for abuse or, in consumer versions, even used to improve the models. Enterprise plans usually offer better contractual guarantees, but the data still leaves your own infrastructure.
What the nDSG means for AI
The revised Swiss Federal Act on Data Protection (nDSG) has applied since 1 September 2023. It does not ban cloud AI, but it sets clear rules whenever personal data is involved:
- Transparency: people must be informed about how their data is processed.
- Data security: you must protect personal data with appropriate technical and organisational measures.
- Disclosure abroad (Art. 16 nDSG): data may only go to countries with adequate protection, or with additional safeguards such as standard contractual clauses.
- Data protection impact assessment (Art. 22 nDSG): required where processing may pose a high risk to the people concerned.
On top of this come industry rules, for example professional secrecy for lawyers, doctors and fiduciaries, or FINMA requirements for financial institutions.
Four options, from open to private
- Public chatbots: fine for general text, not for confidential or personal data.
- Enterprise cloud AI: contractual protection, but data still processed by the provider, often abroad.
- Open-source models with a Swiss host: modern models in a Swiss data centre, under your contract.
- On-premise LLMs: models run on your own servers, and no data leaves the company.
Checklist: when a private LLM makes sense
- You regularly work with personal, health, financial or client data.
- You are bound by professional secrecy or industry regulation.
- Your clients ask where their data is processed.
- You want to use AI across the whole company, not just for single tasks.
- You want to avoid dependence on one external provider and its pricing.
If you tick two or more of these boxes, a private or Swiss-hosted LLM is worth a closer look. Current open-source models such as Llama and Mistral handle most office tasks very well, and a pilot on your own data quickly shows whether they fit your needs.
This article is general information and not legal advice. For specific legal questions, please consult a data protection specialist.