What does the revised Data Protection Act regulate?
The revFADP protects personal data of natural persons, such as customer contacts, employee data or orders from private individuals. Data about companies is no longer covered since the revision. Anyone processing personal data must inform transparently, protect the data appropriately and consider data protection when planning systems (privacy by design).
Does the revFADP require data to be stored in Switzerland?
No. Personal data may be disclosed abroad if the Federal Council has certified that the country provides adequate data protection, or if additional safeguards exist, such as standard contractual clauses. If you host in a Swiss data centre, you do not need to resolve these questions for the hosted systems. They remain for cloud services with servers abroad, support provided from abroad or backups at other locations.
What applies to IT providers and hosting partners?
If a provider processes personal data on your behalf, for example for hosting, remote maintenance or support, the law calls this processing by a processor. You remain responsible and must ensure that the provider only processes the data as you would be allowed to, and guarantees data security. This is set out in a contract, often called a data processing agreement. Further subcontractors require your consent.
What additional duties do SMEs have?
- Privacy notice: inform which data is processed for what purpose and to whom it is disclosed.
- Record of processing activities: mandatory from 250 employees; smaller companies are exempt unless they process sensitive data on a large scale or carry out high-risk profiling.
- Data security breaches: report to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible if there is a high risk for the persons concerned.
- Data protection impact assessment: before processing that poses a high risk to the persons concerned.
For intentional breaches of certain duties, the revFADP provides for fines of up to CHF 250,000. They are imposed on the responsible individuals, not on the company.
Checklist: what should SMEs check for hosting?
- Where are the servers, where are the backups, and from where is support provided?
- Is there a data processing agreement with all providers that see personal data?
- Are access, encryption, backups and recovery defined and tested?
- Is it clear who reports a data breach and how quickly the provider informs you?
- Are the privacy notice and, if required, the record of processing activities up to date?
How does elvadata help?
We run our clients’ systems in the Swiss data centre of our partner Netrics, and the data stays in Switzerland. Our information security management system is built to the standards of ISO 27001. Legal questions are best clarified with your legal advisor; we handle the technical implementation with you. More on the topic in our guide Hosting in Switzerland.