EasyLPD
Self-assessment

Data breach: do I have to notify the FDPIC? Free Swiss FADP and GDPR check

Data lost, stolen, deleted by mistake or sent to the wrong person: that is a breach of data security. Answer a few questions for a first estimate of what to do.

Your answers stay in your browser: nothing is sent or stored.

Was the data encrypted or otherwise unusable for whoever received it?

For example a stolen encrypted laptop, with the key kept safe.

Is the data delicate?

Health data or other sensitive personal data, financial data, passwords, identity documents.

Does it concern many people?

More than a handful of people, or a whole list of customers or employees.

Could the data be misused?

For example a theft, an attack, an unknown recipient. No if whoever received it by mistake has confirmed they deleted it.

Does the GDPR apply too?

Yes if you have an establishment in the EU or target people in the EU, and the breach concerns them.

The answer

Answer the questions to see the answer.

What the law says

A breach of data security is any breach of security that leads to the accidental or unlawful loss, deletion, destruction or modification of personal data, or to its disclosure or being made accessible to unauthorised persons (Art. 5 let. h FADP). The FADP requires it to be notified to the FDPIC as soon as possible if it is likely to result in a high risk for the data subjects (Art. 24 FADP); the GDPR requires notification within 72 hours, unless a risk is unlikely (Art. 33 GDPR).

This tool's estimate of the risk is a starting point: the assessment remains yours and depends on all the circumstances, such as the type of data, the number of people, who received it and what you can still do.

What the FDPIC's form asks

  • the type of breach and, if possible, when it happened and how long it lasted;
  • the categories and approximate number of data records and of data subjects;
  • the consequences and the risks for the data subjects;
  • the measures taken or planned;
  • a name and a contact.

Related questions

Useful templates

General guidance, not advice on your case: for your case the text of the law is what counts, and the assessment remains yours.