Start from the Swiss destination test
The Federal Data Protection and Information Commissioner explains that disclosure abroad depends on the destination’s protection and any necessary safeguards. The Federal Council’s list in the Data Protection Ordinance is the relevant Swiss reference; an EU adequacy assumption is not a substitute. Record the recipient country, legal entity, access locations, and any onward transfer before selecting the instrument with counsel. A global lab may involve several recipients rather than one headquarters address.
Check transparency and the corpus
The regulator also identifies a duty to inform people about disclosure abroad. Gather the collection notice and its versions alongside the rights to the underlying material. For a Swiss business archive, distinguish employee-created documents, customer submissions, licensed publications, and third-party attachments. Owning the storage account does not establish the right to commercialise everything inside it. If your corpus also originated in the EEA, ask whether additional obligations follow that provenance.
Keep the commercial scope narrow
Prepare a schedule describing whether the lab may inspect, train, fine-tune, evaluate, or redistribute the material. A small synthetic extract can demonstrate schema quality and domain coverage while the transfer analysis remains open. Do not label pseudonymised records anonymous without an assessment of linkage risks, especially for small professional communities or rare events. Ask the buyer how subcontractors are approved and how the supplier will learn about changes in access countries.
- Keep the Swiss transfer rationale with the contract version used.
- Document excluded confidential material and third-party restrictions.
- Agree a change-review process before adding sources or recipients.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.