Data protection for fiduciaries: Swiss FADP, payroll and client data
By Advisorn · updated on 26 October 2026
In brief
A fiduciary is the controller for the data of its own clients and staff, but is as a rule a processor when it runs the payroll or keeps the accounts for a client (Art. 9 FADP). These mandates require a data processing agreement with each client, security measures suited to financial and payroll data, and the duty to inform the client without delay of a breach (Art. 24 para. 3 FADP).
The typical data
- data of the clients and their contact persons;
- salaries, AHV data, withholding tax and social insurance of the clients' employees;
- tax returns, bank statements and accounts;
- medical certificates and sick leave, for the insurers;
- data of the firm's own staff.
Sensitive personal data
Payroll hides sensitive personal data: church tax reveals religious affiliation, sick leave and allowances reveal health data (Art. 5 let. c FADP). They must be protected as such.
Two different roles
For its own clients, its own staff and its marketing the fiduciary decides for itself: it is the controller, with all the duties. When it processes the payroll or keeps the accounts on the client's instructions, it processes the data on the client's behalf: it is a processor, and the client must have a contract with it (Art. 9 FADP).
For tax advice or auditing, where the fiduciary decides how to work, its role may be that of an independent controller: it is worth clarifying mandate by mandate.
What to put in the contract with the client
- subject matter and duration of the processing, categories of data and of data subjects;
- instructions, confidentiality and security measures;
- the list of sub-processors, such as cloud accounting or payroll software;
- assistance with data subjects' requests and with breaches;
- return or deletion of the data at the end of the mandate, subject to the retention periods.
Professional secrecy
Auditors bound to secrecy under the Code of Obligations are subject to professional secrecy (Art. 321 Swiss Criminal Code). For other mandates secrecy arises from the contract: it must also be put in writing for staff and sub-processors.
Related questions
- Do we need a contract with vendors that process data for us?
- What are joint controllers?
- What data security measures does the new FADP require?
- How long may personal data be kept?
- An e-mail with personal data went to the wrong person: is it a breach?
- Can Microsoft 365 or Google Workspace be used under the new FADP?
Useful templates
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Privacy notice template for customers and contractual partners
- Technical and organisational security measures (TOMs) template
- Data retention policy template with retention periods
- Data security breach procedure template (data breach)
- Employee confidentiality undertaking and instructions template
The other sectors
General information, not advice on your case: for your case the text of the law is what counts, and for a sector with rules of its own, those rules too.