Data protection in Switzerland: a practical guide to the nFADP

The Federal Act on Data Protection (FADP) is one of the cornerstones of secure data management in Switzerland. Since 1 September 2023, when the fully revised act came into force, businesses have had to pay closer attention to how they collect, store and use personal information. With business processes becoming ever more digital, data protection is a legal obligation and also a key factor of trust for customers and staff.

What the FADP (Federal Act on Data Protection) is and who has to comply with it

The FADP sets out how personal data must be processed. It applies to all businesses, whatever their size, including micro-businesses, SMEs, online shops and professional practices that collect information about employees, customers or suppliers. Data collected through digital tools, business software, CRM systems or the cloud also falls within the scope of the act.

Which data is protected

The FADP defines personal data as any information that directly or indirectly identifies a natural person, such as:

• First name and surname
• Email or postal address
• Telephone number
• Bank or payment details
• Sensitive information (health, biometric)

This data requires protection measures in proportion to how sensitive it is.

Key principles of the FADP

Businesses must respect a number of key principles:

1. Lawfulness and fairness: data must be processed lawfully and transparently.
2. Proportionality: collect only the data you need.
3. Transparency: inform people about how their data is processed and used.
4. Security: take appropriate technical and organisational measures against unauthorised access or loss.

The rights of data subjects

The act guarantees data subjects certain rights:

• Access to their own data
• Correction of inaccurate information
• Erasure of data , where provided for
• Information on how their data is processed

Businesses must be able to meet these requests promptly and with proper records.

Practical obligations for businesses

To comply with the FADP, businesses must:

• Document the data collected and the purposes of processing
• Write a clear privacy notice
• Protect IT systems and access
• Train employees on data handling procedures
• Check that suppliers and partners comply with the law

FADP and GDPR: the main differences

Many businesses work with European customers or partners, so the GDPR may apply to them. Although they are not identical, the FADP and the GDPR share many principles: complying with the nFADP is a big step towards meeting the European rules as well.

The risks of non-compliance

Careless data handling carries significant risks:

• Legal penalties and fines
• Reputational damage
• Contractual problems with suppliers and partners
• Loss of customer trust

How easy4you supports businesses

easy4you helps SMEs comply with the FADP by offering:

• Analysis of business processes and the data processed
• Help drawing up privacy notices and policies
• Staff training
• IT protection and security measures
• Ongoing advice on regulatory updates

The aim is to make data management simple, secure and part of your business processes.

Conclusion

Complying with the nFADP is mandatory: every digital business has to approach data protection in a structured way. Making the right choices today means avoiding problems tomorrow and strengthening the trust of customers and employees.

Want to find out whether your business complies with the FADP? Contact us for a free consultation!