Doxxing and privacy law: GDPR, DSA and Switzerland
Understand when to consider GDPR erasure and regulator complaints, a DSA illegal-content notice, or a Swiss data protection request.
EU: GDPR erasure and complaints
Article 17 of the GDPR · EUR-Lex sets grounds for requesting erasure from a controller. Examples include data no longer needed for its original purpose or unlawfully processed data. The right has exceptions, including for freedom of expression and information, legal obligations and legal claims. Article 77 provides a right to complain to a supervisory authority. The EDPB can help identify the authority.
EU: Digital Services Act notices
Article 16 of the Digital Services Act · EUR-Lex requires covered hosting services to provide a mechanism for notices about alleged illegal content. Give the exact location, explain the legal basis and factual context, and supply the contact and good-faith information the form requests. The DSA process does not itself decide whether a particular disclosure is unlawful.
Switzerland: FADP and the FDPIC
The Swiss FADP · Fedlex covers data protection rights. Article 25 addresses access, and Article 32 describes civil claims, including seeking deletion in relevant cases. The FDPIC / PFPDT / EDÖB explains its complaint route. A regulator report and a civil claim are separate procedures.
Which route should I use?
If the post appears to violate a platform’s privacy rules, report it there first where safe. If invoking a law, identify the service, country and facts that make it relevant. For urgent threats or questions about a court order, seek local professional help. See Doxxing removal request template and Where to report doxxing.