Swiss FADP for SMEs: Compliance Guide
Federal Act on Data Protection (FADP): understand obligations, implement compliance and avoid sanctions
> New FADP: Fundamental Principles
Lawfulness, good faith and proportionality: Data processing must be lawful (legal basis), transparent (persons informed), and limited to necessary data. Purpose limitation: data collected for specific, explicit and legitimate purpose. No reuse for incompatible purpose. Data minimization: collect only strictly necessary data. Storage limitation: keep data only as long as necessary.
Accuracy and security: Data must be accurate and up-to-date. Incorrect data: rectify or delete upon request. Security: implement appropriate technical and organizational measures according to risk (encryption, access control, backups, staff training). Security breach: notify Federal Data Protection Commissioner (FDPC) if high risk to individuals, and inform affected persons.
Individuals' rights: Right of access: person may request what data is processed about them (free response within 30 days). Right to rectification: correct inaccurate data. Right to deletion ("right to be forgotten"): delete data if no longer necessary or unlawfully processed. Right to object: oppose processing for direct marketing. Right to data portability: receive data in structured, commonly used format.
International transfers: Transfer to foreign country only if adequate level of protection. EU/EEA: adequate. USA: verify recipient under Privacy Framework or implement safeguards (standard contractual clauses, binding corporate rules). Other countries: case-by-case assessment. Violation of transfer rules: criminal sanctions possible (fine up to CHF 250,000).
> SME Obligations
Register of processing activities: All companies must maintain internal register describing data processing (categories of persons, data, purposes, recipients, countries of destination, retention periods, security measures). No filing obligation with authority, but must be able to present register upon request. Exemption: companies with fewer than 250 employees AND low-risk processing (occasional, no sensitive data, no mass profiling). In practice: almost all SMEs must maintain register.
Privacy policy: Document mandatory on website and available to customers/employees. Content: identity of data controller, processing purposes, data categories, recipients (subcontractors, partners), international transfers, retention periods, individuals' rights (access, rectification, deletion, objection), contact details for requests. Update: at each significant modification of processing. Clear, accessible and understandable language (avoid legal jargon).
Consent: Required for: sensitive data processing (health, biometrics, race/ethnicity, religious beliefs, political opinions, trade union membership), profiling with high risk, automated decisions with significant effects. Consent conditions: freely given, specific, informed, unambiguous (clear affirmative act). Withdrawal: person may withdraw consent at any time. Pre-ticked boxes invalid. Must be able to prove consent obtained.
Staff training: All employees handling personal data must be trained on FADP principles, company procedures, security measures, what to do in case of breach. Minimum training: at hiring, then annually. Documentation: keep proof of training provided (attendance sheets, training modules). Confidentiality commitment: each employee must sign confidentiality clause in employment contract prohibiting disclosure of data.
> Special Cases and High Risks
Sensitive data: Data revealing: race/ethnic origin, political/religious/philosophical opinions, trade union membership, health, sex life/orientation, genetic/biometric data. Processing: requires explicit consent or specific legal basis (employment contract for health data of employees, legitimate interest with safeguards). Additional security measures: strong encryption, restricted access, impact assessment.
Profiling and automated decisions: Profiling: automated analysis to evaluate personal aspects (performance, behavior, preferences). High-risk profiling: if systematic, massive, sensitive data or vulnerable persons. Prohibition: automated decisions with significant effects without human intervention (credit refusal, recruitment, insurance). If automated decision: right for person to request human review, express point of view, contest decision.
Data Protection Impact Assessment (DPIA): Mandatory if processing presents high risk to individuals. Cases: large-scale systematic monitoring (video surveillance, geolocation), mass processing of sensitive data, profiling with significant effects, new technologies with high risk. Procedure: describe processing, assess necessity/proportionality, identify risks for individuals, plan mitigation measures. Consult FDPC if high residual risk.
Security breaches: Breach: unauthorized access, loss, destruction, alteration, disclosure of data. Notification to FDPC: mandatory "as soon as possible" (48-72h recommended) if high risk to individuals. Information to affected persons: if high risk and no mitigating measures. Content of notification: nature of breach, likely consequences, measures taken/planned. Failure to report: CHF 50,000 fine. Prevention: incident response plan, regular tests, backups.
> Sanctions and Responsibilities
Criminal sanctions (individuals): FADP provides for criminal sanctions against natural persons (managers, employees) who intentionally violate certain obligations. Punishable acts: violation of information/cooperation duties vis-à-vis FDPC (max. CHF 250,000), violation of professional secrecy by data protection advisor (max. CHF 250,000), non-compliance with FDPC decisions (max. CHF 250,000). Complaint: FDPC or injured person may file criminal complaint. Statute of limitations: 3 years.
Administrative sanctions: FDPC may: conduct investigations, request information and documents, issue recommendations, order cessation of violations, order rectification/deletion of data, prohibit or restrict international transfers. Failure to comply with FDPC order: criminal sanction (fine up to CHF 250,000). FDPC publishes its decisions: reputational risk for company. Company: may be ordered to bear costs of investigation and procedure.
Civil liability: Person harmed by unlawful data processing may claim: cessation of violation, damages (material harm: financial losses, non-material: moral harm), compensation for non-pecuniary damage (CHF 1,000-50,000 according to case law). Reversed burden of proof: company must prove it is not at fault or acted diligently. Collective actions: consumer associations may act. Insurance: professional liability insurance may cover damages (check policy).
Indirect consequences: Reputational damage: loss of customer/partner trust. Commercial consequences: clients may terminate contracts, partners refuse collaboration. Media coverage of violations. Loss of competitiveness: customers prefer compliant competitors. Regulatory costs: investigation, legal advice, compliance implementation. Director liability: managers may be held personally liable if serious breach of duties. Prevention remains most economical.
> Subcontracting and Contracts with Service Providers
Data processor: Service provider (hosting, IT maintenance, accounting, marketing) processing data on your behalf is "processor". You remain "controller" (responsible for compliance). Processor obligation: act only on your instructions, not use data for own purposes, implement appropriate security measures, delete/return data at end of contract. Written contract required specifying these obligations.
Content of processor contract: Processing subject and duration, nature and purpose of processing, data types and categories of persons, controller and processor obligations and rights, security measures required, rules on sub-processors (prior written authorization), assistance to controller for individual rights and compliance, conditions for deletion/return of data at end of contract, possibility of audits and inspections. Contractual clauses: specific FADP clauses, not generic terms.
Selection and audit of processors: Before mandating: verify processor guarantees (certifications ISO 27001, references, security audit), location of servers (Switzerland, EU/EEA preferred), existence of sub-processors and their location, security measures implemented, experience in your sector. During contract: right to request security reports, conduct audits (or mandate third party), verify incidents. Upon termination: request deletion certificate or return of data.
Common service providers: Cloud hosting (AWS, Microsoft Azure, Google Cloud): verify data location (CH/EU region), use standard contractual clauses if USA. Email/productivity (Google Workspace, Microsoft 365): configure security options, limit data collected. CRM/ERP (Salesforce, SAP): verify compliance, configure access rights. Accounting software: prefer Swiss or EU providers. Marketing (Mailchimp, HubSpot): verify compliance FADP/GDPR, configure options. Check each provider's privacy policy.
> Websites, Cookies and Digital Marketing
Website cookies: Technical cookies (session, authentication): no consent required. Analysis/statistics cookies (Google Analytics, Matomo): consent required unless anonymization (IP truncation, no cross-site tracking). Marketing/advertising cookies (Google Ads, Facebook Pixel): consent required. Cookie banner: present choices clearly, "reject all" option as easy as "accept", no pre-ticked boxes. Cookie policy: list cookies used, purposes, duration, processors, withdrawal option.
Analytics and tracking: Google Analytics: configure IP anonymization, disable data sharing with Google, use consent management. Alternative: Matomo (self-hosted, no transfer), Simple Analytics (privacy-first). Facebook Pixel: requires consent before installation, inform about transfer to USA, allow opt-out. Tag Manager: audit all installed tags, remove unnecessary ones, configure according to consent. Heatmaps/session recording: inform clearly, exclude sensitive pages (forms, payment).
Email marketing and newsletters: Double opt-in mandatory: confirmation email after signup, subscription active only after click. Content of consent: inform about frequency, content, right to unsubscribe. Each email: unsubscribe link visible and functional. Purchased lists: prohibited without prior consent of persons. B2B: direct marketing to professional addresses tolerated if sectoral link and easy unsubscribe option. Proof of consent: keep date, IP, content of consent message. Unsubscribe: effective within 48h maximum.
Social media and advertising: Facebook/Instagram Ads: standard contractual clauses with Meta, inform about transfer to USA, allow opt-out. Google Ads: similar, configure conversion tracking with consent. LinkedIn: B2B advertising tolerated, respect professional settings. Remarketing: requires consent, inform about personalized tracking. Custom Audiences (import email lists): verify consent obtained for this use. Privacy on company pages: inform employees before publishing photos/names.
> Practical Compliance for SMEs
Immediate actions (week 1-2): Inventory existing data processing (customers, employees, suppliers, partners), Identify processors (hosting, accounting, etc.) and check contracts, Draft or update privacy policy on website, Implement cookie banner with consent management, Train key team on FADP basics. Cost: CHF 0-2,000 if in-house, CHF 2,000-5,000 if external consultant. Priority: high visibility (website, cookies).
Short-term actions (month 1-3): Create register of processing activities (detailed description of each processing), Review and update processor contracts (add FADP clauses), Establish procedure for individual rights (access, rectification, deletion), Implement technical security measures (strong passwords, 2FA, encryption, backups), Draft employee confidentiality clauses, Test incident response procedure. Cost: CHF 3,000-10,000. Priority: compliance foundation.
Medium-term actions (month 3-6): Conduct DPIA if high-risk processing, Establish comprehensive documentation (procedures, policies, training records), Organize staff training (all teams), Audit main processors (security, compliance), Implement data retention and deletion policy, Review international transfers and safeguards, Test and document incident response. Cost: CHF 5,000-20,000. Priority: complete compliance.
Continuous compliance: Annual review of register and procedures, Staff training (at least annually), Processor audits (every 1-2 years), Privacy policy updates (after significant changes), Incident monitoring and breach tests, Regulatory watch (FDPC decisions, case law), Internal audit or external compliance assessment (every 2-3 years). Annual cost: CHF 2,000-10,000 depending on size. Compliance is ongoing process, not one-time project. Continuous improvement approach.
FAQ
Q: Must my SME appoint a data protection officer?
R: No mandatory appointment in Switzerland (unlike GDPR). Recommended if: large-scale processing, sensitive data, high-risk profiling. May be internal employee (part-time) or external consultant.
Q: Can I use Google Analytics or Facebook Pixel?
R: Yes, but with consent (cookie banner) and appropriate configuration (IP anonymization for GA, information on transfer to USA). Consider privacy-friendly alternatives like Matomo or Simple Analytics.
Q: What to do if a customer requests deletion of their data?
R: 1) Verify identity of requester, 2) Delete data within 30 days unless legal retention obligation (accounting, tax: 10 years), 3) Confirm deletion in writing to requester. Document request and action taken.
Q: What does my SME specifically risk for non-compliance?
R: Criminal fine up to CHF 250,000 for manager if intentional violation. Civil damages. FDPC order to cease violation. Reputational damage. Customer/partner loss. In practice: small violations rarely prosecuted, but serious or repeated violations may result in sanctions.
Q: How much does FADP compliance cost for an SME?
R: Initial implementation: CHF 5,000-20,000 (consultant, tools, training). In-house: CHF 2,000-5,000. Annual maintenance: CHF 2,000-10,000. Depends on size, complexity, existing compliance. Failing to comply potentially much more expensive (fines, damages, reputation).
Q: Must I inform my existing customers of nFADP changes?
R: No general obligation to re-inform. But update your privacy policy and: if significant processing changes (new purposes, new recipients, new transfers), inform affected customers. If you lacked valid consent for sensitive processing, request it now. Otherwise, updated policy on website sufficient.
Q: How to know if I must conduct impact assessment (DPIA)?
R: Conduct DPIA if: large-scale systematic monitoring (video surveillance, geolocation), mass processing of sensitive data, profiling with significant effects on individuals, new technologies with unclear risks. If doubt: conduct simplified DPIA (1-2 pages) or consult specialist.
Need help with FADP compliance?
Our legal AI analyzes your needs and guides you
Legal disclaimer:
This guide provides general information on the Swiss FADP and does not constitute personalized legal advice. Data protection is evolving, and interpretations may vary. For a precise analysis of your situation and complete compliance implementation, we recommend consulting a lawyer or specialist in data protection. Use our AI assistant for initial guidance.