What data security measures does the new FADP require?
By Advisorn · updated on 25 October 2026 · Art. 8 and 61 let. c FADP, Art. 1-6 Data Protection Ordinance, Art. 32 GDPR
In short
The FADP requires technical and organisational measures that ensure security appropriate to the risk (Art. 8 FADP). The ordinance specifies the objectives: data must be accessible only to authorised persons, available when needed, not modified without authorisation and processed in a traceable way (Art. 1-3 Data Protection Ordinance). Whoever wilfully fails to meet these minimum requirements risks a fine (Art. 61 let. c FADP).
Typical measures for an SME
- personal log-ins, rights limited to what each person needs and two-factor authentication;
- regular updates, antivirus and firewall;
- regular backups, kept separately and tested;
- encryption of laptops, phones and external media;
- written rules for employees and training on phishing and the use of data;
- contracts with, and checks on, the vendors that process data for you;
- a procedure for breaches of data security.
When more is needed
Whoever processes sensitive personal data on a large scale or carries out high-risk profiling by automated means must keep processing regulations (Art. 5-6 Data Protection Ordinance) and, if preventive measures are not enough, log the operations on the data (Art. 4 Data Protection Ordinance).
The measures must be reviewed over the whole duration of the processing and adjusted where needed (Art. 1 para. 5 Data Protection Ordinance).
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.