Swiss data protection checklist for SMEs: what the 2023 revision means
Practical steps for Swiss SMEs under the revised Federal Act on Data Protection, from notices and contracts to security and incident response.
By Ralph Heezen
The revised Swiss Federal Act on Data Protection has applied since 1 September 2023. Organisations with established GDPR processes already have useful foundations, but Swiss requirements and exceptions still need individual assessment.
FADP and GDPR#
Both protect personal data but differ in formal requirements. Swiss record-keeping exemptions for smaller organisations are conditional; high-risk processing can still require a register. Cookie and consent requirements depend on processing, profiling, transfers and applicable law. Impact assessments are required where processing is likely to create high risk.
Three priorities#
1. Provide clear information#
Maintain an accurate privacy notice explaining collection, purposes, recipients, international transfers and relevant retention information. Provide a contact for access requests and explain individuals’ rights.
2. Document processors#
Identify external providers processing personal data, such as analytics, email, CRM and hosting. Establish appropriate processing contracts. International transfers may require recognised safeguards such as Standard Contractual Clauses, assessed for the destination and provider.
3. Implement security#
Appropriate technical and organisational measures include encrypted transport, access controls, role permissions, backups with restoration tests and employee training.
Common omissions#
- Subprocessors: check the actual provider chain and, where relying on the Swiss–US Data Privacy Framework, applicable certification.
- Recruitment records: define and apply deletion periods rather than retaining applications indefinitely.
- Incident response: Art. 24 FADP requires notification to the FDPIC as soon as possible where a breach is likely to pose high risk. Swiss law does not impose a universal 72-hour deadline. The FDPIC guide explains assessment and notifications.
Our approach#
Document processing and storage locations and assess duties by provider and role. Swiss hosting can support residency requirements but is not always the best-value choice. A attribution and tracking system improves technical control without replacing consent or assessment of your specific setup.
Clear data ownership and processing reduce risk and complexity.
Understand the technical side of FADP
Our architecture overview exposes data flows and controlled access.
View architecture