Why nFADP breach matters now
For SMEs, data protection compliance is often treated as overhead — something the legal or IT team owns, and everyone else quietly ignores. That framing has quietly become untenable. The accountability principle under Art. 5(2) GDPR and Art. 8 revDSG requires documented, demonstrable compliance, and the cost of getting nFADP breach wrong has risen in direct proportion to enforcement intensity.
What this actually looks like in practice
Before going into implementation, it's worth fixing the vocabulary. A surprising amount of the practical confusion around breach notification comes from people using the same words to mean different things. Here are the definitions we work with internally at Innopulse:
Nfadp breach — in the context of breach notification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Swiss breach notification — in the context of breach notification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Gdpr 72 hours — in the context of breach notification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
Fdpic — in the context of breach notification, this refers to the operational reality most DACH SMEs encounter when they move from theory to implementation. The term gets used loosely in marketing material; the regulatory and practical definitions are tighter and worth pinning down.
The implementation path in plain steps
The move from reading about breach notification to actually implementing it is where most SMEs stall. In our experience, the blockage is rarely capability — it's sequencing. Attempting to do everything in parallel burns out the small team that's responsible; attempting to do it in the wrong order means early work has to be redone.
The mistakes that slow everyone down
The first is scope creep disguised as ambition. A project scoped to address breach notification gradually expands to address everything adjacent. By month three, the original deliverable is two quarters away and the team has lost focus. The fix is ruthless: write down what's out of scope as explicitly as what's in.
Our perspective, from running the portfolio
On breach notification specifically, our internal practice has evolved considerably. The early version was manual, error-prone, and didn't scale past three products. The current version is partly automated, documented in runbooks, and survives the addition of new products without degradation.
Where this is heading
Stepping back from the immediate operational picture, breach notification points at some broader shifts in how Swiss and DACH firms are going to operate over the next 24–36 months.
What to do next
If you're reading this because you have an active project around breach notification, here are the next steps we'd suggest — based on where most SMEs we work with are starting from.
Either way: pick your first step, put a calendar date on it, and start.