The new Swiss Data Protection Act: What businesses need to know

The revised Federal Act on Data Protection (revDSG) entered into force on 1 September 2023. Over two years later, many Swiss businesses: particularly SMEs: still have gaps in their compliance.

What changed#

The revDSG aligns Swiss data protection law more closely with the EU's GDPR. Key changes include:

• Scope: Only natural persons are now protected (legal entities are excluded).
• Data Protection Impact Assessments: Required when processing poses a high risk to personality or fundamental rights.
• Data breach notification: Breaches likely to pose a high risk must be reported to the FDPIC as quickly as possible.
• Profiling: High-risk profiling now requires explicit consent.
• Criminal sanctions: Intentional violations can result in fines of up to CHF 250,000: against individuals, not the company.

The practical checklist#

Based on our advisory work, here is what every Swiss business should have in place:

1. Privacy policy updated to reflect revDSG requirements (not just GDPR copy-paste)
2. Record of processing activities (mandatory for companies with 250+ employees, recommended for all)
3. Data breach response plan with clear internal escalation paths
4. Processor agreements (Auftragsbearbeitungsverträge) with all service providers handling personal data
5. Cross-border transfer safeguards: the Federal Council's adequacy list is narrower than the EU's
6. Cookie and tracking consent aligned with current FDPIC guidance

What we see in practice#

The most common gaps are inadequate processor agreements and missing breach notification procedures. Many companies updated their privacy policies but stopped there.

"Compliance isn't a document: it's an operational capability. The privacy policy is the tip of the iceberg." : Dr. Anna Berger

Our recommendation#

Start with a gap analysis. Map your data flows, identify your processors, and test your breach response. If you haven't done this yet, the risk isn't theoretical: the FDPIC has been increasingly active.

We offer a structured half-day workshop that gets SMEs from zero to a practical compliance roadmap. Get in touch if this is relevant for your business.