Does the new FADP apply to my SME?

What counts as personal data

All information relating to an identified or identifiable natural person (Art. 5 let. a FADP): a name, an e-mail address, a telephone number, the data of an employee, a customer or a job applicant. Since 1 September 2023 the FADP no longer protects the data of legal entities.

Almost every business processes it: a list of customers, the payroll or a contact form on the website is enough.

The exceptions

• processing by a natural person exclusively for personal use (Art. 2 para. 2 let. a FADP);
• processing by the Federal Assembly and in court proceedings, which follow their own rules (Art. 2 para. 2 and 3 FADP).

Businesses based abroad

A foreign business that processes data on people in Switzerland falls under the FADP when the processing has an effect in Switzerland (Art. 3 FADP). If it does so regularly, on a large scale and with a high risk, it must designate a representative in Switzerland (Art. 14 FADP).

Related questions

• Revised FADP and GDPR: what are the differences, and when do both apply?
• Is a record of processing activities required under the new FADP?
• What sanctions does the new FADP provide for, and on whom?