Can Microsoft 365 or Google Workspace be used under the new FADP?
By Advisorn · updated on 25 October 2026 · Art. 8, 9, 16, 19 FADP, Art. 28 and 44-46 GDPR
In short
Yes. A cloud service that processes data on behalf of the business is a processor: a contract that complies with Art. 9 FADP is needed and, if the data may go abroad, the conditions of Art. 16 FADP, for example the US company's certification under the Swiss-U.S. Data Privacy Framework or the standard contractual clauses. The large providers offer these contracts; it is up to the business to check them, configure the service and inform people.
What to check
- the provider's data processing agreement and its list of sub-processors;
- where the data is stored and from where it is accessed for support;
- for the United States, whether the company you contract with is certified under the Data Privacy Framework for Switzerland too, or whether the standard contractual clauses are in place;
- the settings: two-factor authentication, external sharing, diagnostic data, retention;
- who in the business is an administrator and what they can see.
If you are bound by professional secrecy
Medical practices, lawyers, fiduciaries and others bound by professional secrecy must also assess whether the provider can access the content and how it is protected, for example with encryption and with secrecy clauses in the contract.
In the documents
The provider must be named among the recipients in the record of processing activities, and the States to which the data goes in the privacy notice (Art. 19 para. 4 FADP).
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.