Switzerland’s new Data Protection Act and what we offer

The revised Federal Act on Data Protection (FADP) has replaced the 1992 act. Together with the Data Protection Ordinance (DPO), it applies from 1 September 2023, with no transition period and regardless of company size. Anyone who runs a website, a shop or a platform processes personal data and is therefore affected.

What the revised FADP requires

The revision has brought the act closer to the European General Data Protection Regulation (GDPR), but has not made it identical. The points with the greatest impact on digital services:

• Only natural persons are protected. Data about a public or private limited company no longer falls under the FADP. Legal entities can no longer invoke it.
• Data protection by design and by default (Art. 7): systems must be built technically and organisationally so that they comply with the principles. The default setting is the data-minimising option, not maximum collection.
• Explicit consent only where it is required (Art. 6 para. 7): it is required for sensitive personal data and for high-risk profiling. Not every processing needs a tick box. It must, however, be recognisable, proportionate and limited to its purpose.
• Record of processing activities (Art. 12): controllers and processors each keep a record. The Federal Council provides exceptions for companies with fewer than 250 employees and low risk.
• Duty to report data security breaches (Art. 24): ‘as soon as possible’ to the FDPIC, as soon as there is a high risk for the data subjects.
• Right of access (Art. 25): every person can find out which data about them is being processed. Access is free of charge and is generally provided within 30 days.
• Data protection advice remains voluntary (Art. 10): private controllers can appoint a data protection advisor, but do not have to. A representative in Switzerland, on the other hand, is mandatory for controllers based abroad if they meet the conditions of Art. 14.

The full text of the act is available as SR 235.1 on Fedlex.

What the penalties are for breaches

Fines go up to CHF 250,000 (Art. 60 ff.), and they are imposed on private individuals, meaning the responsible people, not primarily the company. Offences are prosecuted on complaint. If a fine of no more than CHF 50,000 is being considered and identifying the punishable person would require disproportionate effort, the authority can fine the business instead (Art. 64 para. 2).

Alongside criminal law there is administrative law: the FDPIC can order that processing be adjusted, suspended or stopped, and order the deletion or destruction of personal data (Art. 51). For a running business, this is usually more drastic than the fine.

How best to proceed

A good start is an inventory: which systems process personal data, what data that is, where it comes from, who has access and how long it is kept. This leads to a gap analysis, and that in turn to the list of measures. This is worthwhile even if an analysis for the GDPR already exists: the FADP differs on several points, including the relationship between consent and justification, sanctions and the handling of data about legal entities.

These points belong on the list:

• Privacy policy and duty to inform when collecting data
• a procedure for access and deletion requests that meets the 30 days
• contracts with processors, including subcontractors
• record of processing activities
• reporting process for data security breaches
• disclosure abroad: document the destination country and safeguards
• staff training: most incidents happen in everyday work, not in the code

The website is affected in every case. Visitors leave data behind when they visit, and non-essential cookies and tracking require documented consent or at least a working way to object.

What we take care of for the website

We implement the requirements where they become technically visible: in the front end, in tracking and in operations. The scope:

• support with the privacy policy and imprint
• integration of Cookiebot, adapted to the corporate design
• daily automated checks of the data protection functions with Ghostinspector
• regular evaluation of the Cookiebot data
• annual review of the data protection situation, including a review meeting

Cookiebot: recording and proving consent

Cookiebot scans the website for cookies and trackers, assigns them to categories and displays the banner through which visitors decide. More important than the banner is the log behind it: it records who consented to what and when. Without this proof, consent is worth little in a dispute.

Ghostinspector: a daily test instead of spot checks

A consent banner is not a state but software: a deployment, a new tag in the Tag Manager or an embedded video can suddenly cause things to load before consent is given. Ghostinspector runs through the relevant flows automatically and reports when a data protection function no longer works. The same tests also find perfectly ordinary errors in the checkout process or in forms along the way.

One clean-up is not enough

The FADP cannot be ticked off once and for all. Tools, integrations and case law change, and any one of them can tip a website from compliant to non-compliant. That is exactly why our offer includes an ongoing test and an annual review rather than just a project.

If you want to know where your website stands today: get in touch with us, we will look at the current state and tell you what needs to be done.