The processor: the controller stays responsible

An SME that has its email, accounts or client file hosted by a provider remains the controller under the FADP. The processor handles the data only on instructions and with sufficient security guarantees. The contract describes the subject, duration, nature of the processing and the measures. Disclosure outside Switzerland is lawful only if the statute allows it, in particular where the recipient state ensures an adequate level of protection or appropriate clauses are in place. The provider's name appears in the privacy notice when recipients must be named.