A family office holds one of the densest collections of personal data in the private sector: wealth, family relationships, health questions in succession planning, tax data, identity documents, results of sanctions and media screening. At the same time anti-money laundering law requires much of this data to be collected and kept for a long time. Data protection in this setting is not a formality but a balance between duties pulling in opposite directions.
We write from the implementation side: as data protection advisers and as the operator of FLIORE, a platform that processes exactly this data. The article does not replace legal advice, but it describes the questions that come up again and again in practice.
The framework: the revised FADP
The revised Swiss Federal Act on Data Protection (FADP) has applied since 1 September 2023. It now protects only natural persons; company data no longer falls under it. For family offices the scope remains large, because people stand behind every company: family members, directors, beneficial owners, attorneys. The principles are familiar — lawfulness, purpose limitation, proportionality, data security, transparency — but applying them in a family office is demanding.
Sensitive personal data
The FADP defines a category of sensitive personal data. It includes, among other things, data on health, on religious and philosophical views and data on administrative and criminal proceedings or sanctions. The last category is central for family offices: results of adverse media screening and enquiries into criminal proceedings are exactly such data. Processing them is justified within anti-money laundering duties, but calls for restraint: collect only what is necessary, restrict access, no repurposing.
Health data appears more often than one might think: in advance care directives, in succession planning, in insurance matters. It does not belong in generally accessible filing, and passing it to third parties needs a clear basis.
Retention and deletion
The Swiss Anti-Money Laundering Act requires records to be kept for at least ten years after the end of the business relationship or completion of the transaction (Art. 7). Data protection law requires data to be deleted or anonymised once no longer needed for its purpose. Both apply at once. The solution is a retention rule per data category that names the legal duty as the purpose and the end of the period as the deletion date. What is not subject to retention, such as working notes without evidential function, is deleted earlier. Without such rules, filing grows without limit — and so does the risk in an incident.
Outsourcing to software
Using cloud software for mandates, documents or accounting means a third party processes personal data. The FADP permits this (Art. 9) where a contract or the law provides for it, the data is processed only as the controller itself would be allowed to, and no confidentiality duty stands in the way. The controller must satisfy itself that the provider ensures data security. In practice that means a data processing agreement, a list of sub-processors and a traceable review of security measures. More in our checklist on the data processing agreement.
Family offices face an additional question rarely posed so sharply in ordinary businesses: how is separation between mandates implemented technically? Tenant separation in application logic alone holds as long as nobody forgets a filter. Separation at database level, for example through row-level security, holds even then.
Disclosure abroad
If data sits with a provider abroad or a foreign sub-processor accesses it, that is a disclosure abroad. To states the Federal Council recognises as adequate — including EU and EEA states — this is possible without further safeguards. For the US, the Swiss-US Data Privacy Framework has applied to certified companies since 15 September 2024. In all other cases safeguards such as standard contractual clauses are needed. For many family offices, though, the question is less legal than one of trust: families want to know where their data is. Our decision guide Swiss hosting or EU hosting weighs the options.
AI in the family office
AI assistants that summarise documents or answer questions about mandates are useful and delicate at once in a family office. Three conditions make them usable: the assistant answers only from the data of the mandate in question, it cites its sources, and the data is not used to train models. It should also be clear where model processing takes place, since that too can be a disclosure abroad. FLIORE is built to these three conditions.
Data security breaches
If a data security breach is likely to result in a high risk for the persons concerned, it must be reported to the Federal Data Protection and Information Commissioner as soon as possible (Art. 24 FADP). For a family office, almost any incident involving client data should be assumed to be high risk, because the data concerns wealth, identity and family relationships. A prepared process — who decides, who reports, who informs the families — is therefore mandatory, not optional.
Professional confidentiality and criminal liability
The revised FADP introduced its own criminal provision for breach of professional confidentiality (Art. 62): anyone who wilfully discloses secret personal data entrusted to them in the course of their profession is liable to prosecution, regardless of whether a specific statutory professional secrecy applies. For staff in family offices and fiduciary firms that is one more reason for clear access rules and training. Fines under the FADP are directed at the responsible natural persons, not only at the company.
The exit
A question often missing in software selection: what happens to the data when the contract ends? For a family office with ten-year retention duties, it is not a side issue. Before signing, clarify in which format mandates, documents and history can be exported, how long they remain retrievable after termination and how deletion is confirmed. The glossary entry on vendor lock-in summarises the questions.
Perspective
Data protection in a family office is not a project with an end date but a way of working: collect little, protect well, retain clearly, delete cleanly, and know where the data is in every outsourcing arrangement. Those wanting to approach this in a structured way for their organisation will find our data protection consulting; for day-to-day implementation in a family office, FLIORE is built for the job, with data stored in Switzerland and hard tenant separation.