From today, 1 September 2023, the new Swiss Federal Act on Data Protection (nFADP / nDSG) is in force. The time for preparation is over: the time to be compliant is now.

The pillars of the new law

Privacy by design and by default

Data protection must be built into systems and processes from the outset, not added as an afterthought. Default settings must ensure that only the minimum necessary data is processed.

Records of processing activities

Most companies must maintain a register documenting which personal data they process, for what purposes, where they store it, for how long and who has access. Small companies with fewer than 250 employees have simplified requirements, but maintaining the register is still recommended.

Breach notification

In the event of a data security breach entailing a high risk for the individuals concerned, the company must notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible.

Strengthened data subject rights

Customers, employees and anyone whose data is processed have broader rights: access to their information, rectification, deletion and portability.

The penalties

The nFADP provides for criminal sanctions of up to CHF 250,000 for the natural persons (not companies) responsible for serious violations. Unlike the European GDPR, Swiss penalties apply to individuals rather than organisations.

Alignment with the GDPR

The new law brings Switzerland into alignment with the European GDPR — good news for companies operating with customers or suppliers in the EU: a single reference framework instead of two.

Where to start if you are not yet compliant

  1. Data inventory — map which personal data you process and where it resides
  2. Records of processing — document each processing activity with its purpose, legal basis and retention period
  3. Privacy notices — update information provided to customers, employees and suppliers
  4. Response procedures — define who does what in the event of a data breach
  5. Supplier contracts — verify that contracts with data processors (cloud, software, consultants) comply with the new law

DB Studio can support companies in adapting their document processes and setting up the records of processing activities.

Sources