Does the new FADP require employees to be trained?
By Advisorn · updated on 25 October 2026 · Art. 8 FADP, Art. 1-3 Data Protection Ordinance, Art. 32 and 39 GDPR, Art. 4 AI Act
In short
The FADP contains no explicit duty to train. It does, however, require appropriate organisational measures for data security (Art. 8 FADP), and instructing those who process data is one of the most obvious: many breaches stem from human error. Under the GDPR raising staff awareness is one of the DPO's tasks (Art. 39 GDPR), and the European regulation on AI requires training for those who use AI systems (Art. 4 AI Act).
What it should cover
- what personal data is and which data is sensitive;
- the internal rules: where data is saved, what may be sent by e-mail, which tools may be used;
- how to recognise phishing and what to do after clicking;
- how to recognise a request from a data subject and whom to pass it to;
- what to do at once in case of a breach.
How to prove it
Keep a list of who has attended the training, with date and content, and repeat it periodically, for example every year. It is also useful evidence in case of a breach or an investigation.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.