Question 1

Does the new FADP apply to my SME?

Accepted Answer

Yes. The Federal Act on Data Protection (FADP) applies to every private person and every business that processes personal data of natural persons, whatever its size (Art. 2 FADP). It also applies to a business abroad when the processing has an effect in Switzerland (Art. 3 FADP).

Question 2

Revised FADP and GDPR: what are the differences, and when do both apply?

Accepted Answer

The Swiss FADP and the European GDPR rest on the same principles, but the FADP does not require a legal basis for every processing, sets no deadline in hours for notifying a breach and fines the responsible individuals instead of the business. A Swiss business must also comply with the GDPR when it has an establishment in the EU, offers goods or services to people in the EU or monitors their behaviour (Art. 3 GDPR).

Question 3

What sanctions does the new FADP provide for, and on whom?

Accepted Answer

The FADP provides for fines of up to CHF 250,000 (Art. 60-63 FADP). They are paid by the responsible natural person, not by the business, and only for wilful breaches; the business can be fined up to CHF 50,000 when identifying the responsible person would require disproportionate investigations (Art. 64 FADP).

Question 4

Is a record of processing activities required under the new FADP?

Accepted Answer

Yes, as a rule. The FADP requires controllers and processors to keep a record of their processing activities (Art. 12 FADP). Businesses with fewer than 250 employees are exempt, unless they process sensitive personal data on a large scale or carry out high-risk profiling (Art. 24 Data Protection Ordinance).

Question 5

Do I have to appoint a data protection officer (DPO)?

Accepted Answer

Under the FADP no: for private businesses the data protection officer is optional (Art. 10 FADP). Under the GDPR it is mandatory when the core activities consist of regular and systematic monitoring of people on a large scale or of processing special categories of data on a large scale (Art. 37 GDPR).

Question 6

What must a privacy notice contain?

Accepted Answer

When it collects personal data, the business must inform people at least of: its identity and contact details, the purpose of the processing, the recipients or categories of recipients and, if the data is disclosed abroad, the State and the safeguards (Art. 19 FADP). If the data is not collected from the person, the categories of data processed must also be stated.

Question 7

Is a data protection impact assessment (DPIA) required?

Accepted Answer

Yes, but only when a processing may result in a high risk to the personality or fundamental rights of the people concerned (Art. 22 FADP): for example with new technologies, with sensitive personal data on a large scale or with the systematic monitoring of extensive public areas. If the risk remains high even after the measures, the FDPIC must be consulted (Art. 23 FADP).

Question 8

Can I use vendors with servers in the United States or the EU?

Accepted Answer

Yes. Data may be disclosed abroad if the Federal Council has determined that the State provides an adequate level of protection, as the States of the EU and the EEA do (Art. 16 para. 1 FADP). To the United States it may be transferred to companies certified under the Swiss-U.S. Data Privacy Framework; for the others appropriate safeguards are needed, usually the standard contractual clauses (Art. 16 para. 2 FADP).

Question 9

Do we need a contract with vendors that process data for us?

Accepted Answer

Yes. A business may assign a processing to a vendor (processor) by contract, if the vendor processes the data only in the way the business itself could and guarantees its security (Art. 9 FADP). The vendor may assign it in turn to third parties only with the business's authorisation; under the GDPR the contract must be in writing and have the content of Art. 28 GDPR.

Question 10

Cookies and banners: is consent required in Switzerland?

Accepted Answer

As a rule, no. In Switzerland cookies may be used if the website informs about the processing and its purpose and says how to refuse it (Art. 45c of the Telecommunications Act); prior consent is not generally required. If the website targets people in the EU, their consent is needed before setting cookies that are not necessary (ePrivacy Directive and GDPR).

Question 11

Data security breach: when and how to notify the FDPIC?

Accepted Answer

A data security breach must be notified to the FDPIC as soon as possible when it is likely to result in a high risk to the personality or fundamental rights of the data subjects (Art. 24 FADP). The people concerned must be informed if this is needed to protect them or if the FDPIC requests it; under the GDPR the authority must be notified within 72 hours (Art. 33 GDPR).

Question 12

How to answer a request for access to personal data, and within what time?

Accepted Answer

Anyone may ask a business whether it processes data about them and receive a copy, with the purpose, the retention period, the recipients and the States abroad (Art. 25 FADP). The answer must as a rule be given within 30 days and free of charge (Art. 18-19 Data Protection Ordinance); under the GDPR the deadline is one month (Art. 12 and 15 GDPR).

Questions on the new FADP

Does it apply to us?

Documents and roles

Vendors and abroad

When something happens

Your question is not here?