Data disclosure requirements
12. Are there any local laws that would require a cloud service provider to disclose the data it hosts to any third parties in any circumstances (including regulatory or law enforcement authorities)?

Yes. In civil proceedings, the cloud service provider may be required by the courts to disclose certain information even if it is not party to the proceedings (Article 160 of the Civil Procedure Code, SR 272).

In public law (administrative) proceedings initiated by the Swiss Financial Market Supervisory Authority under its supervisory rights, a request may be made to the cloud service provider to provide information (Article 29 of the Financial Market Supervision Act, SR 956.1). 

In criminal law proceedings, the cloud service provider may be required by the authorities to disclose information (Article 246 of the Criminal Procedure Code, SR 312).

In the course of mutual assistance in criminal matters, cloud service providers may be required to disclose certain information. On request, documents, data or assets seized as evidence for the purpose of forfeiture as well as records and decisions will be made available to the competent foreign authority after conclusion of the mutual assistance proceedings (Article 74 et. seq. of the Mutual Assistance Act, SR 351).

Under data protection laws, the data subjects have no right of disclosure over their data vis-à-vis the cloud service provider but only vis-à-vis the bank that is the data controller.