Ordinance on the
Protection of Federal Information
(Information Protection Ordinance, IPO)

This Ordinance regulates the protection of federal and armed forces information to the extent that national interests so require. In particular, it defines its classification and treatment.

The specific provisions of other legislation are reserved.

This Ordinance applies:

1. to the Federal Administration in terms of Article 6 of the Government and the Federal Administration Organisation Ordinance of 25 November 1998³;

2. to military personnel;

3. to the extent stipulated by federal law or accordingly agreed, to organisations and persons under public and private law who process classified information;

4. to federal and cantonal courts that process classified information, to the extent stipulated by federal law.

In this Ordinance:

1. information means recordings on information carriers and oral statements;

2. information carriers means information media of any kind, such as documents and carriers of text, picture, sound or other data; intermediary data such as drafts are also regarded as information carriers;

3. processing means any activity involving information, regardless of the means used and procedures applied, in particular the compilation, use, processing, copying, making accessible, disclosing, transmitting, taking note of, conservation, archiving and destruction;

4. author means a person, administrative unit, command authority or contractor who produces classified information;

5. holder of classified information, confidant means a person who has been entrusted with classified information;

6. classification means assessing certain information according to the list of classification criteria (Art. 8) and formally marking with a classification label;

7. declassification means the cancellation of the classification label for information that is no longer sensitive;

8. ⁴IT and telecommunication systems means systems and their integrated applications and data collections;

9. IT security means IT security safeguards confidentiality, availability, integrity and reproducibility in electronic data processing;

10. codification means the use of designations and codenames;

11. Encryption means state-of-the-art technical transformation of plain text.

Any person who compiles or issues information requiring protection (sensitive information) shall allocate it to one of the following levels of classification according to its degree of sensitivity:

1. SECRET;

2. CONFIDENTIAL;

3. INTERNAL.

If information carriers are physically merged to form a collection, consideration must be given as to whether it must be classified or given a higher level of classification.

Information is classified as «SECRET» if its disclosure to unauthorised persons may seriously harm national interests. The foregoing applies in particular to information, the disclosure of which may seriously compromise:

1. the capacity to act of the Federal Assembly or Federal Council;

2. the security of the population;

3. the national economic supply or the security of nationally important management facilities and infrastructure;

4. fulfilment of the duties of the Federal Administration, the Armed Forces or essential parts thereof;

5. Switzerland’s foreign policy interests or international relations;

6. the protection of sources or individuals or the secrecy of operational resources and methods of the intelligence services.

Carriers of information classified as «SECRET» must be numbered.

Information is classified as «CONFIDENTIAL» if its disclosure to unauthorised persons may harm national interests. The foregoing applies in particular to information, the disclosure of which may compromise:

1. the free formation of opinions and decision-making of the Federal Assembly or the Federal Council;

2. the proper implementation of specific measures by the authorities;

3. the security of the population;

4. national economic supply or the security of important infrastructure;

5. fulfilment of the duties of parts of the Federal Administration or of the Armed Forces;

6. Switzerland’s foreign policy interests or international relations;

7. relations between Confederation and the cantons or among the cantons themselves;

8. Switzerland’s economic, monetary and currency policy interests.

Carriers of information classified as «CONFIDENTIAL» may be numbered.

Information is classified as «INTERNAL»:

1. if its disclosure to unauthorised persons may be disadvantageous to national interests; and

2. if it need neither be classified as «SECRET» nor «CONFIDENTIAL».⁵

Information from abroad that is classified as «RESTRICTED» or equivalent shall be processed as «INTERNAL» information.

The General Secretaries Conference shall lay down in a list of classification criteria how certain sensitive federal data that occurs frequently must be classified.

Classification must be made subject to a time limit if it can be predicted when it will no longer be sensitive.

Persons who due to their range of duties are to be granted access to classified information must be:

1. carefully selected;

2. obliged to observe secrecy; and

3. correspondingly trained and specialised.

Whether holders of classified information that are to be granted access to «SECRET» or «CONFIDENTIAL» information must undergo a personnel security screening procedure, is governed by the Ordinance of 19 December 2001⁷ on Personnel Security Screening.

The specialist knowledge of holders of classified information pertaining to information protection and IT security must be guaranteed and periodically updated.

Any person who processes classified information is responsible for complying with the regulations on information protection.

Superiors shall regularly check compliance with these regulations.

Compiling, disclosing and making accessible of classified information must be kept to a minimum; in doing so, the situation, assignment, purpose and time should be taken into account.

Classified information may only be disclosed or made accessible to those persons who must know about it.

In the case of requests for access to official documents, the relevant authority shall check whether access should be granted, restricted, postponed or refused in accordance with the Federal Act of 17 December 2004⁸ on Freedom of Information in the Administration, regardless of any classification.

Processing of information from abroad is governed by the relevant information protection agreement. If such an agreement does not exist, the information is processed according to the Swiss classification level that is equivalent to its classification level abroad.

The author of «SECRET» information or «CONFIDENTIAL» information that is numbered shall check its sensitivity and its recipients every five years at least and always with due regard to the obligation to offer to the Federal Archives.

Any person who suspects or establishes that information has obviously been incorrectly or mistakenly not classified must ensure its protection until its classification has been changed.

He or she shall immediately inform the author, who shall immediately take the necessary measures.

Any person who discovers that classified information is at risk, has been lost or misused shall take protective measures and inform without delay his or her superior, the author and the relevant security bodies.

In agreement with the security bodies, the author shall immediately take the necessary measures.

Classified information is archived according to the legislation on archiving.

The processing of classified information and the handling of related information carriers is regulated in the Annex.

The General Secretaries Conference issues regulations on processing.⁹

It regulates simplified handling of information by the intelligence services and the police according to their requirements; in doing so, it shall preserve adequate protection of information in accordance with this Ordinance.¹⁰

The processing of information classified as «SECRET» in the joint reporting procedure under Article 15 of the Government and Administration Organisation Act of 21 March 1997 is regulated by the Federal Chancellery; in doing so, it shall provide adequate information protection in accordance with this Ordinance.¹¹

The Departments and the Federal Chancellery shall each appoint an information protection delegate.

The information protection delegates have the following tasks in particular:

1. They ensure compliance with information protection in their area of responsibility.

2. They periodically check the presence and completeness of information carriers that are classified as SECRET.

The information protection delegates of the Departments and the Federal Chancellery form the Coordination Committee for Federal Information Protection (Coordination Committee).

The Coordination Committee has the following tasks:

1. It prepares for the General Secretaries Conference a list of classification criteria, handling regulations and regulations for simplified handling of information by the intelligence services and the police.

2. It ensures a uniform information protection practice within the Confederation.

3. It coordinates its activities with the IT Security Committee.

4. It guarantees the provision of the information to the General Secretaries Conference.

5. ¹³Every two years, it reports to the General Secretaries Conference on strategic concerns of the Information Protection Report.

6. It may consult other services.

In agreement with the Departments and the Federal Chancellery, it draws up business regulations for itself and the Coordination Agency.

The Coordination Committee is supported by the Coordination Agency. The latter has the following tasks:

1. It manages the secretariat of the Coordination Committee.

2. It is the central point of contact for domestic, foreign and international agencies concerned with information protection.

3. It supports the information protection delegates of the Departments and the Federal Chancellery in its field.

4. It creates the necessary training aids.

5. It may carry out the security inspections required by international treaties and further checks in consultation with the Departments and the Federal Chancellery.

The Coordination Agency is assigned in administrative terms to the General Secretariat of the Federal Department of Defence, Civil Protection and Sport.¹⁵

The Departments and the Federal Chancellery shall implement this Ordinance.

The following are repealed:

1. Ordinance of 10 December 1990¹⁶ on the Classification and Handling of Information from the Civilian Administrative Sector;

2. Ordinance of the Federal Department of Defence of 1 May 1990¹⁷ on the Protection of Military Information (Information Protection Ordinance).

...¹⁸

The classification «INTERNAL» may only be applied to information carriers that are created after this Ordinance comes into force.

Technical adjustments to ensure the protection of information, in particular concerning its classification and handling, must be carried out by 31 December 2009.

This Ordinance comes into force on 1 August 2007 and is valid until 31 December 2011 at the latest.

The period of validity of this Ordinance is extended until 31 December 2014.¹⁹

The period of validity of this Ordinance is extended until 31 December 2017.²⁰

The period of validity of this Ordinance is extended until 31 December 2020.²¹

The period of validity of this Ordinance is extended until 31 December 2023.²²