The revised Federal Act on Data Protection has been in force since September 2023, and most Swiss companies we assess are still partially compliant in the same three places. Not because the law is unclear, but because compliance was treated as a document exercise rather than an inventory exercise.

This is the checklist we work from, written for companies of 10 to 500 people with no legal department and no data protection officer. It is not legal advice, for which you need Swiss counsel, but it is an accurate picture of what the Act and its Ordinance require and of what an assessment actually looks for.

What actually changed

Six changes carry practical weight for a Swiss SME.

ChangeWhat it means in practice
Scope narrowed to natural personsData about companies is out of scope. Many firms over-scoped their inventory and drowned in it.
Privacy by design and by defaultA design duty from the planning stage, not a documentation one. Assessors look for it in architecture decisions.
Register of processing activitiesRequired from 250 employees. Below that, only for large volumes of sensitive data or high-risk profiling.
Breach notificationBreaches likely to cause high risk go to the FDPIC as quickly as possible. There is no fixed hour count.
Wider duty to informPeople are told whenever personal data is collected, not only sensitive data, including the countries it goes to.
Fines on individualsUp to CHF 250,000 for wilful breaches of specific duties, imposed on the responsible person.

The last row changes behaviour more than any other, and it is why data protection moved from a legal topic to a management one. It is also narrower than its reputation. Under the Federal Act on Data Protection the fines apply to wilful breaches of named duties, such as giving people false information, disclosing data abroad without safeguards, or ignoring the minimum security requirements. They are prosecuted by the cantons, on complaint. The company itself can be fined up to CHF 50,000 only where tracing the responsible person would be disproportionate.

The federal SME portal notes that companies already compliant with the GDPR have little to change. That holds for most of the paperwork. In our experience the gaps sit in the details that differ: Swiss privacy notices must name the destination countries, sensitive data now includes genetic and biometric data, and a GDPR template written for an EU entity rarely mentions the Swiss Commissioner at all.

Which duties apply to a company of our size?

Most of them apply to every company, whatever its size: the duty to inform people when collecting their data, appropriate data security, breach notification, an impact assessment for high-risk processing, and answering access requests within 30 days. Headcount matters for one thing only. Companies under 250 employees are exempt from keeping a register of processing activities, unless they process large volumes of sensitive data or carry out high-risk profiling.

That exemption, set out in Article 24 of the Data Protection Ordinance, covers almost every Swiss company. Of more than 626,000 market enterprises counted by the Federal Statistical Office in 2023, only 1,814 had 250 employees or more.

Swiss market enterprises by size class, 2023Bar chart: Micro, under 10, 561,952; Small, 10–49, 52,476; Medium, 50–249, 9,791; Large, 250 and more, 1,814. Source: [Federal Statistical Office, SMEs](https://www.bfs.admin.ch/bfs/de/home/statistiken/industrie-dienstleistungen/unternehmen-beschaeftigte/wirtschaftsstruktur-unternehmen/kmu.html).Micro, under 10561,952Small, 10–4952,476Medium, 50–2499,791Large, 250 and more1,814Swiss market enterprises by size class, 2023Bar chart: Micro, under 10, 561,952; Small, 10–49, 52,476; Medium, 50–249, 9,791; Large, 250 and more, 1,814. Source: [Federal Statistical Office, SMEs](https://www.bfs.admin.ch/bfs/de/home/statistiken/industrie-dienstleistungen/unternehmen-beschaeftigte/wirtschaftsstruktur-unternehmen/kmu.html).Micro, under 10561,952Small, 10–4952,476Medium, 50–2499,791Large, 250 and more1,814
Figure 1 Swiss market enterprises by size class, 2023. Only 1,814 enterprises reach the 250-employee threshold at which the register becomes mandatory whatever data they hold. Source: Federal Statistical Office, SMEs

Size is therefore the wrong first question. The right one is what kind of data you hold. A 40-person online retailer with a customer database and a newsletter is usually exempt from the register, though it still needs a privacy notice that matches what its webshop and marketing tools actually do. A 25-person physiotherapy group processes health data every day, and that changes the answer.

When a register of processing activities is requiredTwo-by-two matrix. Horizontal axis: Sensitive data or profiling risk. Vertical axis: Employees. Top left: 250+, ordinary data, Register required by headcount alone. Top right: 250+, sensitive data, Register, likely impact assessment, logging. Bottom left: Under 250, ordinary data, Exempt, core duties still apply. Bottom right: Under 250, sensitive data, Exemption lost for large volumes.250+, ordinary dataRegister required by headcount alone250+, sensitive dataRegister, likely impact assessment,loggingUnder 250, ordinary dataExempt, core duties still applyUnder 250, sensitive dataExemption lost for large volumesEmployeesSensitive data or profiling riskWhen a register of processing activities is requiredTwo-by-two matrix. Horizontal axis: Sensitive data or profiling risk. Vertical axis: Employees. Top left: 250+, ordinary data, Register required by headcount alone. Top right: 250+, sensitive data, Register, likely impact assessment, logging. Bottom left: Under 250, ordinary data, Exempt, core duties still apply. Bottom right: Under 250, sensitive data, Exemption lost for large volumes.250+, ordinarydataRegister requiredby headcount alone250+, sensitivedataRegister, likelyimpact assessment,loggingUnder 250,ordinary dataExempt, coreduties still applyUnder 250,sensitive dataExemption lost forlarge volumesEmployeesSensitive data or profiling risk
Figure 2 When a register of processing activities is required. At 250 employees headcount alone triggers the register. Below that, the data decides. Source: Data Protection Ordinance, Article 24

Why does health data raise the bar?

Health data is sensitive personal data under the Act, and a practice, clinic or care service processes it in volume from its first week. That usually removes the register exemption, makes an impact assessment likely for any new system that handles patient records at scale, and can add duties under the Ordinance to log access and to write processing regulations for automated processing.

Whether a given practice processes a "large volume" is a judgement the Ordinance leaves open. For a group holding thousands of electronic patient records, keeping a register is cheaper than arguing about the exemption. The same Ordinance requires logging of who stored, read, changed or disclosed the data where large volumes of sensitive data are processed by automated means and preventive measures cannot otherwise guarantee protection, which in practice means the patient record system must keep an access log someone actually reviews.

For healthcare providers this sits alongside professional secrecy, which the Act also backs with fines of up to CHF 250,000 for wilful disclosure. The AI questions that follow, such as transcription and triage tools, are covered in AI in Swiss healthcare: what is allowed, and the practical side of starting out in how a new medical practice gets found.

Does the revised FADP require data to stay in Switzerland?

No. There is no data-residency requirement in the revised FADP. Personal data may go to countries the Federal Council lists as providing adequate protection, and to other countries where appropriate safeguards such as standard contractual clauses are in place. People must be told which countries their data goes to. Swiss hosting is a legitimate business choice, not a legal obligation.

The list sits in Annex 1 of the Ordinance. It includes the EU and EEA states and the United Kingdom, and since 15 September 2024 it also covers US companies certified under the Swiss-US Data Privacy Framework, as the Commissioner announced. For other countries, the Commissioner recognises the EU's standard contractual clauses, and using recognised clauses does not have to be reported, according to its guidance on cross-border transfers.

The flow also works the other way. The European Commission recognises Switzerland as providing adequate protection, so data from EU customers or a parent company can come here without extra safeguards. Residency is often adopted anyway, for customer contracts or supervisory expectations, and that is a business decision to argue on its merits. The practical version of that argument is in cloud migration in Swiss banking, and the questions to ask a cloud or AI provider are in our guide to data readiness for AI.

What does a data protection impact assessment require?

An impact assessment is required before processing that is likely to cause a high risk to people's personality or fundamental rights, typically large-scale processing of sensitive data or systematic monitoring of public areas. It describes the planned processing, evaluates the risks to the people concerned, and sets out the measures that reduce them. If a high risk remains after those measures, the Commissioner must be consulted first.

The Commissioner then has two months to raise objections, extendable by one month for complex processing. A private company that has appointed a data protection officer and consulted that person may skip the consultation. The assessment must be kept for at least two years after the processing ends.

The common failure is not an absent assessment. It is one written after the system was built, which by definition cannot have influenced the design it is supposed to assess. A 30-person clinic choosing a speech-to-text tool for consultations should write the assessment while comparing vendors, because the answers on where audio is processed and how long it is kept are what separate the vendors.

What do we have to do after a data breach?

Report it to the Federal Data Protection and Information Commissioner as quickly as possible if it is likely to cause a high risk to the people affected. The report must describe the nature of the breach, its consequences and the measures taken or planned. Inform the people affected where that is needed for their protection, and keep a record of the breach and your response for at least two years.

The first days after a breachProcess in 4 steps: 1. Contain (Stop the leak, preserve the logs); 2. Assess the risk (Likely high risk to the people affected?); 3. Notify the FDPIC (As quickly as possible, via the portal); 4. Inform and record (Tell those affected, keep the record).01ContainStop the leak,preserve thelogs02Assess theriskLikely highrisk to thepeopleaffected?03Notify theFDPICAs quickly aspossible, viathe portal04Inform andrecordTell thoseaffected, keepthe recordThe first days after a breachProcess in 4 steps: 1. Contain (Stop the leak, preserve the logs); 2. Assess the risk (Likely high risk to the people affected?); 3. Notify the FDPIC (As quickly as possible, via the portal); 4. Inform and record (Tell those affected, keep the record).01ContainStop the leak, preserve the logs02Assess the riskLikely high risk to the people affected?03Notify the FDPICAs quickly as possible, via the portal04Inform and recordTell those affected, keep the record
Figure 3 The first days after a breach. Assess the risk to people, not to the company. A breach that embarrasses you but harms nobody may not need a report, but it still needs a record. Source: Federal Act on Data Protection, Article 24

Unlike the GDPR's 72 hours, the Swiss rule sets no fixed deadline, which is not permission to wait. The Commissioner's online DataBreach portal has been open since before the Act took effect. It confirms the time of reporting and accepts follow-up reports, so missing details can be supplied later. The Commissioner's notice on the obligation is explicit: from 1 September 2023, breaches likely to result in a high risk must be reported as soon as possible.

Two contract points follow. Your processors, meaning the SaaS and IT providers who handle data for you, must tell you of any breach as quickly as possible, so check that their contracts say so and name a contact. And decide in advance who in the company makes the call to report, because the person who discovers a breach on a Friday evening is rarely the person who should decide.

The three findings that come up every time

1. The inventory does not match reality. The register lists the systems someone remembered. The actual estate includes a marketing tool bought on a credit card, a shared drive with fifteen years of files, and an analytics script nobody mapped. Start from network and expense data, not from interviews.

2. Access is granted and never revoked. Support vendors with standing production access, leavers whose accounts persist, and service accounts nobody owns. This is an operations problem rather than a legal one, and it is the same finding that tops cybersecurity priorities for Swiss SMEs.

3. Retention is theoretical. A policy says 90 days. The database has records from

  1. A retention policy that is not enforced by a job is a statement of intent, and

an assessor will read it as one.

A sequence that works

  1. Inventory before policy. Almost every downstream decision changes once you can see what you actually hold.
  2. Fix the access model. Least privilege, reviewed quarterly, revocation tied to the leaver process. This has security value far beyond compliance.
  3. Make retention executable. A scheduled job that deletes records past their window beats a policy document.
  4. Write the register from the inventory, if you need one, not from memory.
  5. Then write the policies and the privacy notice, which now describe what happens rather than what someone hoped would happen.

Companies that do this in the reverse order, policies first, produce a compliant binder and a non-compliant estate.

How long does it take and what does it cost?

For a company of 30 to 200 people with a typical mix of cloud tools, expect two to four months of elapsed time with a part-time internal owner, and expect the inventory to surface at least one access finding that must be fixed before anything else proceeds. Most of the cost is internal time and remediation, not the assessment.

At 20 people with one office suite, a CRM and an accounting package, the inventory can be a few days' work and the effort goes into the privacy notice and the processor contracts. At 200 people, with departments buying their own tools, the inventory dominates. These are typical observations from the assessments we have run, not a quote. Any firm offering a fixed all-in price before seeing the inventory is pricing a document. How to judge the offers is covered in what a Swiss company should pay for consulting.

What this has to do with AI

The Commissioner has stated that the Act is directly applicable to AI-supported processing, including the right to know when you are dealing with a machine. Decisions based exclusively on automated processing that have a legal consequence or a considerable adverse effect trigger a duty to inform, and the person can ask for a human review. If you deploy tools that score people for credit, hiring or fraud, that is in scope, and "the model decided" is not a defence.

This is worth designing for now rather than retrofitting. A chatbot on your website must say it is a chatbot, and an assistant that drafts replies from customer records needs the same access review as any other system, a point developed in which generative AI use cases pay back. Our AI and machine learning work treats the human-review path as part of the architecture, and our cybersecurity work treats the access model as the first deliverable rather than the last.

Sources

Working on this right now?

Tell us where you are in two questions. A consulting partner reviews every enquiry within 2 business days.