Payroll data and the CLOUD Act: what Swiss employers and software vendors need to know

A server located in Switzerland is not enough to put your payroll data out of reach of US authorities. What matters is the legal nationality of the provider that hosts it. If that provider, or its parent company, falls under US law, the CLOUD Act applies, wherever the data centre is.

And payroll is probably the most sensitive dataset a company holds. For every employee it brings together identity, AHV number, salary, bank details, sick leave and sometimes religious affiliation. This article sets out what employers, fiduciaries and payroll software vendors in Switzerland need to know.

The CLOUD Act in brief

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law passed in March 2018. It requires any service provider subject to US jurisdiction to hand over data in its "possession, custody or control" when a US authority demands it as part of an investigation, even if that data is stored outside the United States.

Three points to remember:

• The test is control, not location. A "Switzerland" region of a US hyperscaler is still in scope, because the parent company controls the infrastructure.
• The customer is not necessarily told. The demand targets the provider. The provider can challenge it, but a non-disclosure order can stop it from informing its customer.
• It does not stand alone. Section 702 of FISA separately allows intelligence collection targeting non-US persons, with even less transparency.

Switzerland has not signed a CLOUD Act executive agreement with the United States. The mechanism therefore remains unilateral: a US demand can conflict directly with Swiss law, and it is up to the provider, and then to you, to deal with the consequences. Our guide CLOUD Act and Swiss law covers this conflict of laws in detail.

Why payroll is a special case

On top of ordinary personal data, a payroll file contains several categories that the revised Federal Act on Data Protection (nFADP) classifies as sensitive personal data (Art. 5 let. c), which call for a higher level of protection.

Two obligations specific to employment come on top. Art. 328b of the Code of Obligations limits processing to the data needed to perform the contract. And accounting records must be kept for 10 years (Art. 958f CO), which extends the exposure period accordingly.

Finally, responsibility cannot be delegated. If you hand payroll to a fiduciary or a SaaS product, you remain the controller and must make sure your processors offer sufficient guarantees (Art. 9 nFADP).

What Swiss law says

The nFADP, in force since 1 September 2023, governs any disclosure of data abroad (Art. 16 and 17). Access by a US authority to data hosted by a US provider is, in practice, such a disclosure.

Since 15 September 2024, the Swiss-US Data Privacy Framework has allowed data to be transferred to certified US companies (source). It settles the question of commercial transfers. It does not remove the CLOUD Act or FISA 702: it adds safeguards and a redress route through the FDPIC and a US Data Protection Review Court (source).

Three limits to keep in mind:

• Political fragility. Its two predecessors (Safe Harbor, Privacy Shield) fell after legal challenges in Europe. A framework built on a US presidential executive order can be changed quickly.
• Redress after the fact. Redress comes after the access, not before, and the employee concerned may never know their data was consulted.
• Sector requirements. Some customers (public sector, healthcare, FINMA-regulated finance) contractually require hosting outside any foreign jurisdiction, regardless of the DPF.

In practice, the DPF makes using a US cloud legally defensible. It does not make the risk zero, and it is up to you to document it in your record of processing activities and, for sensitive data, in a data protection impact assessment (Art. 22 nFADP).

Six questions to ask your payroll provider

Whether you use a SaaS product, a fiduciary or your own infrastructure, these questions are enough to locate your exposure.

1. Who actually hosts the data? Not just the country of the data centre, but the company running the infrastructure and its parent.
2. Does that company, or any of its processors, fall under US law? Ask for the full list of processors, including backup, email, support and monitoring.
3. Can support access the data from abroad? Remote access from a third country is also a disclosure abroad.
4. Who holds the encryption keys? Encryption whose keys the provider manages does not protect against a demand addressed to that provider.
5. What does the contract say about a demand from a foreign authority? Notification, systematic challenge, annual transparency.
6. Which certifications can you provide? ISO 27001 at a minimum, and a recent audit report rather than just a logo.

If the answer to 2 or 3 is "yes", the CLOUD Act concerns you. That is not necessarily a deal-breaker, but it must appear in your record and be accepted knowingly.

The practical options

There is no universal right answer. An SME running its own payroll can reasonably accept a documented risk. A payroll software vendor or a fiduciary processing data for hundreds of employers is in a different position: its customers will end up asking the question, often in a security questionnaire or a tender.

In summary

Payroll concentrates sensitive data within the meaning of the nFADP, kept for 10 years, and the employer stays responsible even when it outsources. The CLOUD Act attaches to who controls the provider, not to where the servers are. The Swiss-US DPF makes transfers lawful without removing possible access by US authorities.

The first step is simple: know who hosts your payroll data, and under which law. The rest follows from there. What Hikube can provide on this is on the security and compliance page. Talk to our team.

Matthieu Robin is CEO and co-founder of Hidora, a Swiss cloud operator based in Geneva. Hidora runs Hikube, a cloud platform hosted exclusively in Switzerland and not subject to the CLOUD Act. This article is for information only and does not constitute legal advice.

Sources

• Swiss-US Data Privacy Framework, overview (Clym)
• nFADP compliance checklist 2026 (Global Law Experts)
• List of DPF-certified organisations