Swiss data protection (nFADP): the essentials for SMEs
Since 1 September 2023, the revised Federal Act on Data Protection (nFADP) has applied to every Swiss company. The key obligations and first steps for an SME.
Since 1 September 2023, the revised Federal Act on Data Protection (nFADP) has applied to every company processing personal data in Switzerland, whatever its size. Customer files, HR records, emails, website: virtually every SME is affected.
This article covers the essentials and practical measures. It is not legal advice.
What has changed
- Only data relating to natural persons is protected now; company data no longer falls under the law.
- Genetic and biometric data are now sensitive data, alongside health data among others.
- Privacy by design and by default become mandatory: the most privacy-friendly settings must apply by default.
- Penalties target the individuals responsible: intentional breaches of certain duties can lead to fines of up to CHF 250,000.
Key obligations for an SME
- Inform: people must be told when their data is collected, notably through a privacy policy.
- Secure: technical and organisational measures appropriate to the risk are required (access, passwords, backups, updates).
- Bind your processors: hosting providers, cloud services, accountants and IT vendors must be bound by a contract that guarantees data protection.
- Answer requests: anyone can request access to their data; the answer is in principle due within 30 days.
- Report breaches: a data security breach likely to result in a high risk must be reported to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible.
- Assess risks: a data protection impact assessment is required before any processing likely to result in a high risk.
- Keep a record of processing activities: companies with fewer than 250 employees are in principle exempt, unless they process sensitive data on a large scale or carry out high-risk profiling.
Health data
Medical practices, radiology centres, physiotherapists, laboratories: health data is sensitive data. Security requirements are higher, and the record-keeping exemption may not apply. In this sector, data protection is as much about IT infrastructure as about paperwork.
Transfers abroad
Using a cloud service hosted outside Switzerland is possible, but regulated: the destination country must offer adequate protection according to the Federal Council’s list, or contractual safeguards must be in place. The United States is only considered adequate for companies certified under the Swiss-U.S. Data Privacy Framework. Before choosing a provider, find out where your data is stored and who can access it.
Where to start?
- Map the personal data you process: what data, where, for what purpose and with which vendors.
- Publish a clear privacy policy on your website.
- Review your contracts with IT processors.
- Check the security basics: two-factor authentication, tested backups, updates, access rights.
- Define a data breach procedure: who decides, who reports, and how quickly.
- Train your staff: they remain the first line of defence.
In short
The nFADP does not require turning an SME into a bureaucracy. It requires knowing what data you process, protecting it reasonably and being able to prove it. Much of that work is technical, and that is where technology leadership makes the difference.