The Canton updates its regulatory framework. The new LPDP strengthens a model based on the accountability of public bodies, risk prevention and data protection by design.
For more than thirty years, data protection within Ticino’s public bodies has been governed by a law adopted in 1987, in a technological context that was profoundly different from today’s environment. The current landscape has changed radically: interconnected databases, digital services, automated systems, artificial intelligence and new technological tools have transformed the way public administrations collect, use and share personal information.
With the approval of the complete revision of the Cantonal Data Protection Act (Legge cantonale sulla protezione dei dati personali – LPDP), Ticino updates its regulatory framework, aligning it with developments that have taken place in recent years at both federal and international level. The revision was approved by the Grand Council on 15 September 2026.
From formal compliance to active accountability
The new law marks an evolution in the approach to data protection. The regulatory framework no longer focuses solely on defining formal obligations but requires public bodies to develop stronger organisational capabilities in managing processing activities, through risk assessments, the adoption of appropriate measures and the ability to demonstrate compliance with applicable legislation.
The principle of accountability, already established under the Swiss Federal Data Protection Act (FADP) and the European General Data Protection Regulation (GDPR), is therefore strengthened. According to this principle, the controller must be able to demonstrate the adequacy of the measures adopted.
This approach reflects the evolution of Swiss and European data protection legislation in recent years and was identified by the Council of State as one of the main objectives of the reform.
Privacy by design and by default: protection becomes part of the design process
The new framework introduces and strengthens a preventive approach to data protection management, with particular attention to processing activities that may pose high risks to the fundamental rights and freedoms of data subjects.
One of the key instruments is the Data Protection Impact Assessment (DPIA), which enables public bodies to identify potential issues in advance, assess risks and define appropriate technical and organisational measures before certain processing activities are initiated.
The objective is to prevent data protection issues from being addressed only after an incident has occurred, promoting instead a model based on prevention and proactive risk management.
At the same time, the new LPDP provides a more detailed framework for the management of personal data breaches, introducing an obligation to notify the competent authority where a breach may result in a significant risk to the individuals concerned, in line with the requirements established by the Swiss Federal Data Protection Act.
Where personal information is compromised, the event must therefore be analysed, assessed and managed through structured procedures.
In a context where public bodies are also potential targets of cyberattacks, the ability to prevent, detect and rapidly respond to incidents becomes an integral component of data protection.
A supervisory authority with an enhanced role
The reform also strengthens the role of the Cantonal Data Protection Officer (Incaricato cantonale della protezione dei dati – ICPD), giving greater importance to supervisory and control activities.
The data protection authority will have an increasingly significant role in ensuring that organisations subject to the law implement appropriate measures considering the complexity of their processing activities and the related risks.
What changes for municipalities and public bodies?
The new LPDP directly applies to:
- the Canton;
- municipalities;
- public law entities and institutions;
- private entities entrusted with public tasks.
For these organisations, the challenge will not only be legal but, above all, organisational. The approval of the law represents the first step in an adaptation process requiring:
- updating internal regulations and procedures;
- clearly defining roles and responsibilities in data management;
- reviewing relationships with suppliers and technology partners;
- training personnel involved in processing activities.
Public sector privacy enters a new phase
The new Ticino LPDP comes at a time when the amount of data generated and processed by public institutions is rapidly increasing.
Digital records, online administrative services, automated systems and emerging technologies make one question increasingly central: How can data be used to improve public services without compromising individuals’ rights?
The answer provided by the new law is based on key principles: greater transparency, greater accountability and greater prevention.
Because data protection is not only about information security, but also about maintaining the relationship of trust between citizens and institutions.
Sources
- Republic and Canton of Ticino – Complete revision of the Cantonal Data Protection Act (LPDP).
- Government Message No. 8281 of 17 May 2023 – Complete revision of the Cantonal Data Protection Act.
- Council of State of the Canton of Ticino – Communication on the complete revision of the LPDP and the objectives of the reform.
