GDPR and revFADP: what changes for those handling EU data

A Swiss company that sells to German, French or Italian customers, or that handles data of residents in the European Union, has to reckon with two sets of data protection rules: the revised Federal Act on Data Protection (revFADP), in force since 1 September 2023, and the European GDPR. They are not alternatives: both may apply. Let’s look at what changes and what to do in concrete terms.

Two laws, one common theme

The revFADP modernised Swiss law by bringing it closer to European standards, precisely to ensure that Switzerland continues to be regarded by the EU as a country with an adequate level of protection. This recognition is crucial: it allows the free flow of data between the EU and Switzerland without additional safeguards.

For this reason the revFADP and the GDPR share the same underlying structure: transparency towards data subjects, data security, rights of access and erasure, accountability for those who process data. But practical differences remain that are worth knowing.

Who has to apply what

The first step is to understand which set of rules applies, and often the answer is “both”.

revFADP: applies to data processing carried out in Switzerland or having effects in Switzerland. It therefore concerns every Swiss company.
GDPR: has extraterritorial reach. It also applies to a Swiss company with no permanent establishment in the EU if it offers goods or services to people in the EU or monitors their behaviour.

In practice, the Swiss company that has customers in the EU, an e-commerce operation selling in Europe or that profiles European users must consider the GDPR as well, in addition to the revFADP.

The practical differences that count

Despite the similar structure, some points diverge and need to be managed.

Data of legal entities

The revFADP protects only the data of natural persons. So does the GDPR. On this the new Swiss law has aligned: unlike the previous one, company data is no longer covered.

Penalties

Here the difference is marked. The GDPR provides for administrative penalties of up to EUR 20 million or 4% of worldwide turnover. The revFADP instead provides for fines of up to CHF 250,000 directed at the responsible natural persons (not at the company as such), typically the decision-makers. Different logics, but both with real consequences.

Record of processing activities

Both require it, but the revFADP provides exemptions for SMEs with fewer than 250 employees, except for high-risk processing or the large-scale processing of sensitive data.

Data protection officer

The GDPR imposes one in specific cases. The revFADP does not make it mandatory, but provides for the figure of the data protection adviser on an optional basis, with certain procedural advantages.

Breach notification

Both require it, but with different thresholds and timescales: the GDPR sets the well-known 72-hour deadline, the revFADP requires notification “as soon as possible” when the risk to data subjects is high.

What to do in concrete terms

For a Swiss company with EU customers, the practical path is this.

Map the processing activities: which data you collect, from whom, for what purposes, where it ends up. Without this basis nothing can be built.
Check the dual applicability: if you process data of people in the EU to offer services or monitor their behaviour, align the procedures to the more demanding level, usually the GDPR.
Update the privacy notices: transparent, complete and consistent with both sets of rules.
Take care of transfers to third countries: towards the EU the flow is facilitated by mutual adequacy; towards other countries specific safeguards are needed.
Prepare the procedures for data subjects’ rights: access, rectification, erasure, objection. You must be able to respond within the prescribed times.
Set up a plan for breaches: who does what, by when, to which authorities.

The mistake to avoid

The most common risk is thinking “I’m Swiss, the revFADP is enough for me”. If you have customers or users in the EU, the GDPR reaches you anyway, with its much heavier penalty apparatus. It is better to set up from the start processes that satisfy both, avoiding having to comply in an emergency after a complaint or an inspection.

Our approach

At SIH ONE we help Swiss companies to map their processing activities, understand which rules really apply to their case and build a single compliance that answers both the revFADP and the GDPR. No duplicated or pointless formalities: processes calibrated to the data you handle and the markets in which you operate.

Do you handle data of customers in the EU and want to be compliant with both laws? Let’s check it together.