Meet Swiss FADP data protection duties with less manual work

The FADP is Switzerland's Federal Act on Data Protection, the national law governing how personal data about individuals is processed. The fully revised version, adopted on 25 September 2020, came into force on 1 September 2023 and replaced the 1992 Act. It sets processing principles, controller and processor duties, data subject rights and criminal penalties, and is supported by the Data Protection Ordinance. The FDPIC supervises its application.

Private persons, including companies, and federal bodies that process personal data of natural persons must comply with the FADP. It applies to circumstances that have an effect in Switzerland even if initiated abroad, so foreign businesses serving Swiss customers can be in scope. Data about legal entities is no longer protected under the revised Act. Some foreign controllers must also appoint a representative in Switzerland under Article 14.

The FADP provides for criminal fines of up to CHF 250,000 for wilful breaches of specific duties, such as information and access obligations, duties of care on cross-border disclosure, processors and minimum data security, and professional confidentiality. Unlike the GDPR, fines are generally imposed on the responsible individuals rather than the company, although a business can be ordered to pay a fine of up to CHF 50,000 in limited cases.

The FADP is closely aligned with the GDPR but is not identical. Both require privacy by design, records of processing, impact assessments for high risk processing and breach notification. Key differences include criminal fines on individuals of up to CHF 250,000 rather than percentage-based corporate fines, breach notification to the FDPIC as quickly as possible rather than a fixed 72 hours, and no general requirement for a legal basis for private processing.

Under Article 24, a controller must notify the FDPIC as quickly as possible of any breach of data security that is likely to lead to a high risk to the data subject's personality or fundamental rights. The notification must at least describe the nature of the breach, its consequences and the measures taken or planned. Processors must notify the controller of any breach as quickly as possible, and affected individuals must be informed where needed for their protection.

Yes, partly. ISO 27001 controls provide strong evidence for the FADP's data security duty in Article 8 and the minimum security requirements in the Data Protection Ordinance, as well as breach handling and supplier management. ISO 27001 does not cover privacy specific duties such as information to data subjects, rights of access and portability, records of processing and cross-border disclosure rules, so you need privacy controls alongside it.

It depends on your starting point. Organisations already compliant with the GDPR usually have most foundations in place and mainly need to address Swiss specific points, such as privacy notice content, cross-border disclosure rules and any representative requirement. Organisations starting from scratch need to map their processing, build a record of processing activities, set up rights handling and breach procedures, and evidence data security measures.

The FADP is mapped in OneClickComply's control library and is available on request. That means controls and evidence you already hold for GDPR, ISO 27001 or SOC 2 can be mapped to FADP duties such as data security, records of processing and breach notification. OneClickComply does not certify compliance, but our in-house audit team can guide you through Swiss specific requirements.