Data protection in Switzerland: what companies need to do to comply with the nFADP

Since 2023, the new Federal Act on Data Protection (nFADP) has been in force, updated to align with the European GDPR standards. Looking ahead to 2025-26, Swiss companies need to prepare for stricter checks and closer attention from federal authorities. Complying with the nFADP means protecting sensitive data and avoiding penalties, and for anyone handling customer data it's also a matter of trust.

Main obligations for companies

The responsibilities imposed by the new FADP cover the management of personal data at every stage of its processing:

Processing register

Every company must document how it collects, stores and uses the data of customers, suppliers and employees. Digital tools such as spreadsheets or secure cloud software can make this task easier.

Transparent consent

Users must be clearly informed about how their data will be processed and must be able to withdraw their consent at any time.

Breach notification

Any data breaches must be reported without delay to the Federal Data Protection and Information Commissioner (FDPIC).

Impact assessments

Mandatory if the processing involves high risks, for example biometric data, health data or artificial intelligence systems.

Protection by design & by default:

Digital systems must be designed with built-in security from the outset.

Types of sensitive data

Companies need to pay particular attention to high-risk categories of data, such as:

• health data of employees or customers;
• biometric information;
• financial data;
• personal data of minors or other protected categories.

For each type of data, it's necessary to assess the risks and, where needed, carry out a Data Protection Impact Assessment (DPIA).

Obligations towards suppliers and external cloud providers

Many SMEs rely on external suppliers for cloud, marketing or HR services. It's essential to:

• select suppliers that comply with the FADP;
• include clear contractual clauses on the roles of data controller and data processor;
• carry out periodic audits to check data protection;
• prefer servers located in Switzerland to reduce legal risks and unauthorised international transfers.

Practical solutions for compliance

Some concrete measures companies can take:

• Internal policies: managing access, backups and document retention;
• IT security: firewalls, up-to-date antivirus software, data encryption;
• Staff training: raising awareness among all staff, including IT, about risks and procedures;
• Digitalisation: using secure cloud tools, CRM systems and HR software hosted on Swiss servers.

Practical example: an SME with 30 employees that adopts local cloud systems and updates its internal policies can cut the risk of breaches by 70% and simplify periodic checks.

E-learning and training with easy4you

Company culture is essential. Even the best protection systems aren't enough if employees don't know the rules. In about a month, easy4you will be launching a dedicated e-learning system on IT security, with modular courses on:

• managing sensitive data;
• identifying risks and phishing;
• safe use of email, cloud services and company devices;
• practical simulations of data breach scenarios.

This training significantly reduces the risk of human error, penalties and reputational damage, turning the expense into a genuine investment for the company.

Differences from the European GDPR

• Territorial scope focused on the Swiss market;
• Proportionate obligations for SMEs, but strict for sensitive data;
• Penalties of up to CHF 250,000;
• Focus on the proportionality of measures, avoiding excessive burdens for small businesses.

Conclusion

From 2025-26, the new FADP doesn't radically change the rules, but it does require companies to be ready to:

• protect the sensitive data of customers and employees;
• reduce legal risks and penalties;
• strengthen trust and reputation;
• promote an internal culture of digital security.

We at easy4you support SMEs in tackling FADP compliance simply and securely, combining digital tools, company policies and practical staff training. Integrating technology with company culture is today the most effective strategy for reducing risk and ensuring continuity and trust in the business.

For a personalised assessment of your company's compliance status, get in touch: we'll look at how you handle data today and what's missing to be compliant.