The new Swiss Data Protection Act (nFADP)

Since 1 September 2023, the new Federal Act on Data Protection (nFADP) has been in force, replacing the previous law and bringing Switzerland into line with European standards. Many SMEs have treated it as just one more piece of red tape; others have ignored it, hoping it didn’t concern them. Both reactions are wrong. The nFADP affects almost every business, because almost every business processes personal data — of clients, suppliers and employees. Let’s look at what really changes and what to do in concrete terms.

What the nFADP protects

The Act protects the personal data of natural persons: any information relating to an identified or identifiable individual. Name, address, email, payment details, but also information about staff or clients. Unlike the European regime, Swiss law no longer covers the data of legal entities: it focuses on natural persons.

A key principle: the law does not prohibit processing data, but requires it to be done lawfully, transparently and proportionately, for specific and recognisable purposes. Whoever processes the data is responsible for how they do it.

The main obligations for an SME

The nFADP introduces or reinforces a number of concrete duties.

• Information: at the point of collection, individuals must be told who is processing the data, for what purposes and, where relevant, to which recipients — typically through a clear and accessible privacy notice.
• Record of processing activities: businesses must, in principle, keep a record of what data they process and why. Relief is provided for SMEs whose processing entails a limited risk to individuals.
• Data security: technical and organisational measures appropriate to the risk, to protect data against unauthorised access and loss.
• Breach notification: in the event of a security breach entailing a high risk to individuals, the Federal Data Protection and Information Commissioner (FDPIC) must be informed as quickly as possible.
• Individuals’ rights: those whose data is processed can request access, rectification and, in the cases provided for, erasure. The company must be able to respond.
• Privacy by design and by default: protection must be built into processes from the outset, not bolted on afterwards.

Particular attention must be paid to sensitive personal data (health, opinions, biometric data, trade-union or religious affiliation) and to profiling, for which the law provides reinforced safeguards.

The issue of cross-border transfers

Many SMEs use cloud tools, CRMs or email marketing services hosted outside Switzerland. Transferring personal data abroad is possible, but only to countries that guarantee adequate protection or, failing that, by adopting appropriate safeguards (for example, recognised contractual clauses). It is one of the points where businesses go wrong most often, frequently without realising it.

Differences from the European GDPR

The nFADP is inspired by the GDPR but is not identical. Those already compliant with the GDPR have done most of the work, but not all of it.

• The framework is similar: transparency, purpose limitation, data subjects’ rights, security.
• Penalties work differently: the nFADP provides for fines that primarily target the responsible natural persons (up to CHF 250,000 in the cases provided for), rather than the company as such in the first instance. This is an important shift in perspective for management.
• Some obligations and thresholds differ. A business also active towards the EU must consider both regimes.

What to do in practice

Getting compliant does not necessarily require a huge project, but it does call for an orderly path.

1. Map your data: what personal data you collect, where you store it, who accesses it, where it goes (including abroad).
2. Update the privacy notice on your website, forms and contracts.
3. Draw up the processing record, proportionate to your organisation.
4. Check your suppliers: do your service providers process the data in a compliant way? Adequate agreements are needed.
5. Define procedures for responding to access requests and for handling any breach.
6. Train your people: most incidents arise from behaviour, not technology.

How we work

SIH ONE is an AI-native fiduciary group with a division dedicated to law and governance. We help SMEs assess their exposure, map their processing activities, prepare proportionate notices and records, and correctly manage cross-border transfers and supplier relationships. The goal is substantive compliance, not a binder of documents no one uses.

Want to understand where your business is exposed under the nFADP? Let’s take stock together.