The new Swiss Federal Act on Data Protection (FADP)

The protection of personal data has become a central issue for SMEs as well as for large companies. With the growing use of digital tools, customer management software, email marketing and cloud systems, every business, large or small, handles sensitive data every day: names, email addresses, phone numbers, information about suppliers and customers. This is why Switzerland has a specific law governing how this data must be collected, processed, protected and stored: the Federal Act on Data Protection (FADP).

Although Swiss legislation in this area dates back to the 1990s, in 2020 it is still essential for anyone working in the digital world to understand what it means to protect the data of their customers and employees, both to comply with the law and to build trust and professionalism in the digital age.

What is the FADP (Federal Act on Data Protection)?

The FADP is the Swiss law that governs the processing of personal data. Its main purpose is to protect the personality and fundamental rights of natural persons when their data is collected, processed or used by companies or organisations.

In practice, the FADP lays down the basic rules on:

• what is meant by personal data;
• when and how it may lawfully be processed;
• the rights of data subjects (e.g. access, rectification, erasure);
• the obligations of those who handle the data (companies, service providers, etc.);
• the penalties for breaches.

Who has to comply with the FADP?

The law applies to anyone who processes personal data in Switzerland, namely:

• companies and SMEs that handle customer or employee data;
• providers of digital services;
• public bodies that collect and process data within the Confederation.

It is worth stressing that there is no minimum company size for the FADP to apply: even a small business or a self-employed professional who collects customer data must follow the basic rules.

What is "personal data"?

Personal data is any information relating to an identified or identifiable natural person. For example:

• first name and surname
• postal or email address
• phone number
• payment details
• information about customers, suppliers or employees

In certain cases, data such as an IP address or digital identities can also count as personal data if they make it possible to trace a person.

The fundamental principles of data protection

The FADP is based on a few key principles that every company must respect:

Lawfulness

Data processing must be lawful. There must be objective grounds (such as the performance of a contract or explicit consent) for collecting and using the data.

Transparency

People must know why their data is being collected, how it will be used and how long it will be kept.

Security

Companies must take technical and organisational measures to protect data from unauthorised access, loss or misuse.

Rights of data subjects

The FADP gives users certain rights over their own data. These include:

• the right of access: knowing what data is being processed;
• the right to rectification: correcting inaccurate data;
• in some cases, requesting erasure or restriction of processing.

Users must be able to exercise their rights easily, and companies must have internal procedures for handling these requests.

Obligations for companies

SMEs also need to consider some key responsibilities:

Obligations for companies

Every company should know where and how it collects data, who has access to it and why it is processed.

Have adequate security measures

Collecting data is not enough on its own: sensitive information has to be protected with suitable tools, such as backups, secure access and internal policies.

Allow data subjects to exercise their rights

It must be easy for a customer or employee to request access to their data or its erasure.

What happens if you do not comply with the FADP

Although the 1992 FADP did not provide for penalties as high as those under the European GDPR, failing to comply with the law can still bring legal risks, reputational damage and complaints from users.

This is why it is important to take preventive measures and approach data protection in a structured way.

Practical tips for Swiss SMEs

To stay in line with the FADP, SMEs can:

• draw up an internal data policy for data processing;
• update the privacy consents on their web pages and forms;
• put secure digital tools in place for storing customer and employee data;
• train staff on the risks linked to data protection.

Beyond the legal obligation, it is also a question of reliability and of the trust you build with customers and partners.

How easy4you can help

easy4you supports Swiss SMEs in putting processes in place that comply with the FADP:

• analysis of the data processed within the company;
• definition of policies and procedures;
• support in drafting privacy notices and consents;
• practical staff training.

With our help, privacy becomes a competitive advantage instead of a problem you have to deal with on your own.

Conclusion

Data protection in Switzerland is a concrete legal reality that affects every company processing personal information. Even in 2020, before the new FADP comes into force, it is essential for SMEs to be aware of their obligations and to take practical measures.

Would you like to find out whether your company complies with data protection law?
Contact us for a free consultation.