Guide
A new Federal Act on Data Protection (FADP) has been in force since 1 September 2023. Here are the main obligations, with the articles and what EasyLPD does for each.
Every private company and association that processes data about people in Switzerland, whatever its size.
It applies as well if you have an establishment in the EU, if you offer goods or services to people there or if you monitor their behaviour.
Fines of up to CHF 250'000, imposed on the person responsible, not on the company.
Whoever collects personal data must say who they are, for what purpose they process it, to whom they disclose it and whether they send it abroad.
With EasyLPD: Privacy notices for clients, staff, applicants, the website and video surveillance, filled in with your data.
A list of the activities involving personal data: purposes, categories, recipients, retention, measures.
With EasyLPD: The record is written from the data audit, group by group.
Technical and organisational measures appropriate to the risk.
With EasyLPD: The security measures as a document, with the right questions.
Whoever processes data on your behalf must have a contract and guarantees.
With EasyLPD: Processing agreements, security questionnaire, the vendor's signature online.
Before processing with a high risk, a data protection impact assessment.
With EasyLPD: The guided assessment, with advice on when it is needed.
A breach with a high risk must be reported to the FDPIC as soon as possible.
With EasyLPD: The countdown and the details ready for the FDPIC's form.
Right of access, rectification, erasure: generally within 30 days.
With EasyLPD: Each request with its deadline and the steps to take.
Transfers to countries without adequate protection require safeguards.
With EasyLPD: The list of countries with adequate protection and the status of each vendor.
The self-assessment tells you which ones concern you and where you stand, in a few minutes.
A summary to help you find your way, not advice: for your case, the text of the law prevails.
