Data protection under the Swiss FADP and GDPR: duties, processes and evidence
The revised Swiss Data Protection Act has applied since September 2023; for companies with EU customers the GDPR comes on top. In practice, knowing the rules matters less than whether processes and evidence work day to day.
This topic page collects our content on the basics, on evidence such as the record of processing, TOMs and DPIAs, on data breaches and access requests, plus the matching checklists and offers.
Terms
- Swiss FADP (revFADP)
- GDPR
- Record of processing activities
- Technical and organisational measures (TOMs)
- Data Protection Impact Assessment (DPIA)
- Data protection representative (Art. 14 FADP, Art. 27 GDPR)
- Data Protection Officer (DPO)
- Privacy notice
- Consent
- Adequacy decision
- Data breach notification
- Processing on behalf (Art. 9 FADP, Art. 28 GDPR)
- Anonymisation and pseudonymisation
- Right of access (Art. 25 FADP, Art. 15 GDPR)
- Deletion concept
- Privacy by Design
- Standard contractual clauses (SCC)
- Data Privacy Framework (DPF)
- CLOUD Act
- Disclosure abroad (Art. 16 and 17 FADP)
- Data portability (Art. 28 FADP, Art. 20 GDPR)
- Transfer impact assessment (TIA)
- Data classification
- Permission concept (access control concept)
- Legal notice duty (Switzerland and Germany)
- Cookie consent
Articles
- GDPR vs Swiss DSG: Where they diverge
- Transferring personal data to the US under the Swiss FADP: Data Privacy Framework, standard clauses and the risk after June 2026
- The data breach playbook: preparation, roles and communication before the incident
- Data subject requests in SMEs: a workflow for access, erasure and data portability
- Data protection in the family office: Swiss FADP, professional secrecy and outsourcing to software
Checklists
- Checklist: documenting technical and organisational measures (TOMs)
- Checklist: carrying out a data protection impact assessment
- Checklist: reviewing a privacy notice under the FADP and GDPR
- Checklist: implementing cookies and consent correctly
- Checklist: answering access requests under the Swiss FADP and GDPR
- Reviewing a data processing agreement: what to look for before signing
- Checklist: data breach — the first 72 hours
- GDPR for SaaS: what has to stand before your first enterprise customer
Offers
Services
More topics
- Anti-money laundering compliance in Switzerland: AMLA, SRO, KYC and transparency register
- Public procurement in Switzerland: procedures, criteria and bids
- Cybersecurity for SMEs: reporting duties, baseline protection and incident planning
- AI regulation: EU AI Act, AI governance and the Swiss perspective
- Requirements and projects: requirements engineering, HERMES and acceptance
LM
Reviewed by
Founder & CEO · MSc Innovation Management (FFHS) · PMP · IREB CPRE · Author of “Identity Over Discipline”
Mandates incl. EDA, MeteoSwiss, FSO, SERI, FINMA, Swisscom and BLS