Revised Swiss data protection act, fifteen months on: what SMEs must have in place
- 1The revised FADP penalises responsible individuals personally, including management, so compliance is a governance matter and not only an IT one.
- 2Six workstreams cover most of the ground: records, notices, processors and transfers, security and breaches, individual rights, and AI use.
- 3A record of processing activities remains the foundation, even where the law exempts a company with fewer than 250 employees.
- 4Staff use of generative AI tools is now the most common leak and one of the simplest to fix.
Since 1 September 2023, the revised Federal Act on Data Protection (FADP) has applied to every company in Switzerland, whatever its size. Fifteen months on, the picture we see in SMEs is fairly consistent: a privacy notice rewritten in a hurry, sometimes adapted from a European template, and not much behind it. Yet the law does not ask for a document. It asks that the company knows what it does with personal data and can demonstrate it.
Two points make the subject more serious than it looks. First, criminal fines (up to CHF 250,000) target the responsible individuals in the first place, which often means management rather than the company. Second, most SMEs have added cloud tools, service providers and, more recently, AI assistants, which has moved data outside its usual perimeter without anyone deciding it.
This guide sets out six steps, in the order we usually address them.
Step 1: know where the data is
Everything starts with a map. For each activity (payroll, recruitment, invoicing, CRM, support, website, video surveillance), note which personal data is processed, for what purpose, where it is stored, who can access it and how long it is kept.
The law generally exempts companies with fewer than 250 employees from keeping a record of processing activities, unless they process sensitive data on a large scale or carry out high-risk profiling. The exemption is misleading: without a record, it is very hard to answer an access request, assess a breach or qualify a service provider. We recommend a simple record, kept in a spreadsheet, with one owner per line. It is also the prerequisite for any AI project, as we argued in No AI without clean data: the project SMEs keep postponing.
Step 2: give notice in a way you can verify
The duty to inform applies at every point of collection, not only on the website. Candidates, customers, employees, visitors and business contacts must know who processes their data, for what purposes, to whom it is disclosed and in which countries. Three issues come up often:
- the privacy notice describes processing that no longer exists, or omits processing that does;
- application forms and employment contracts do not refer to it;
- recipients abroad are not mentioned.
The test is simple: the notice should be derivable from the record, not the other way round.
Step 3: control processors and transfers
Hosting provider, payroll software vendor, emailing tool, fiduciary, IT contractor: each processes data on your behalf. The law requires a contract or equivalent basis, appropriate security guarantees and control over the use of sub-processors.
For transfers outside Switzerland, three situations arise. The country is on the list of those offering adequate protection, which is the case for the European Union. Or the recipient is covered by a recognised framework, such as the Swiss-US Data Privacy Framework, applicable since September 2024 to certified US companies. Or standard contractual clauses are needed, completed by the Swiss addendum. An SME with ten software providers can usually handle this in a few weeks, provided it starts with the five that hold the most sensitive data.
Step 4: security and breach handling
The law requires technical and organisational measures proportionate to the risk, and notification to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible of any breach likely to result in a high risk for the individuals concerned. There is no fixed number of hours as in European law, but "as soon as possible" is measured in days, not weeks.
What is most often missing is not technology but procedure: who decides that an incident is a breach, who contacts the Commissioner, who informs the individuals, where the incident is logged. One page of instructions, one name per role and one dry run a year are enough for an SME. Companies that also operate in the EU or France should align this procedure with the GDPR's 72-hour deadline.
Step 5: be ready for individual rights
Access, rectification, deletion, data portability: an access request must in principle be answered within 30 days. These requests are rare, but they often arrive in tense circumstances, such as a dispute with a former employee or a commercial conflict. The risk is to discover at that moment that the data is scattered across mailboxes, shared folders and three applications.
Good preparation means one single entry point, a response template and a list of the systems to search. Our use case Client data privacy compliance shows how this work is structured around customer data, where volumes are highest.
Step 6: set boundaries for generative AI
This is now the most common leak. Employees paste customer letters, CVs or contract extracts into a consumer assistant, usually with good intentions. The FADP applies in full: it is processing, sometimes a transfer abroad, with no contractual basis.
A proportionate answer has four parts: a list of approved tools, a clear rule on the data that must never be entered, professional accounts with suitable retention settings, and short training. For companies that sell or deploy AI systems in the EU, the AI Act, in force since 1 August 2024, adds phased obligations: prohibitions from February 2025, rules for general-purpose models from August 2025, and most other requirements from August 2026. That timetable leaves room to build an inventory of AI uses, which fits naturally on top of the record from step 1.
An order of magnitude for a 60-person company
Take, as an assumption, a 60-person services SME with about a dozen applications holding personal data and six significant processors. A first full cycle (record, updated notice, review of six contracts, breach procedure, access procedure, AI rule) typically represents in the order of 10 to 15 person-days, spread over two to three months, about half of it from management and business owners. Maintenance afterwards is in the order of a few days a year. These figures are a basis for reasoning, not a promise: they vary widely with data sensitivity and the quality of what already exists.
Running the topic without building a machine
Three governance choices make the difference. Appoint a responsible person, internal or external, with a clear mandate; the law allows for a data protection advisor. Put the topic on the leadership agenda twice a year, with three indicators: processing activities reviewed, processor contracts regularised, incidents logged. And embed checks in existing processes (buying a tool, starting a project, hiring) rather than creating a parallel circuit.
Regulatory change, in Switzerland and in the EU, is frequent; light monitoring avoids finding out by chance, as our case Automated regulatory monitoring shows. For our overall approach, see our Data, AI & compliance page.
Where to start this week
List the ten applications and providers that hold the most personal data, name an owner, and check three things: the contract exists, the country of processing is known, and the privacy notice reflects it. This exercise takes a few hours and already gives a faithful picture of your exposure. If you would like an outside view of your situation and a prioritised action plan, our diagnostic is the most direct starting point.
A personalised first reading in three minutes.