Data protection training for employees in Switzerland

Data protection training for employees in Switzerland

Data protection training for employees is not named word for word in the Swiss FADP, but it is one of the most common ways to meet the duty to take appropriate technical and organisational measures for data security under Art. 8 FADP. Your staff handle customer mail, HR files and cloud tools daily. Training turns written rules into behaviour people actually use when autocomplete fails or a customer asks for data by phone.

This checklist is for owners and HR in a Swiss company with about 20 to 250 staff, often without a dedicated data protection officer. It is orientation, not legal advice.

What belongs in the session

Cover what personal data are in your firm, lawful bases in plain language, minimum necessary when copying data, how to send files safely, when to escalate a mistake, and when a breach may need an FDPIC report. Mention GDPR only if you actually sell or market to people in the EU. Include role examples: reception verifying callers, finance checking payment data, managers approving photos for the website.

Training on the FADP and the GDPR means staff understand both frameworks where they apply. One course does not replace access controls, contracts with processors or your retention rules. It shows what everyday handling looks like and where to report a mistake.

• What counts as personal data in your tools
• Wrong recipient and lost device: internal report first
• High-risk breach: FDPIC path, as fast as possible
• Phone and email identity checks before disclosure
• Clean desk and secure disposal for paper
• Where to find the privacy notice and contact person

A workable 90-minute live agenda

Live sessions pay off when people ask about your CRM, payroll export or the office WhatsApp group. A structure many SMEs use:

1. 15 minutes: your data map

   Which systems hold personal data, who can access them, where the privacy notice lives, and who answers internal questions.

2. 25 minutes: everyday mistakes

   Wrong recipient, oversized attachments, reply-all errors, USB sticks, private phones for customer photos. The internal reporting path in one slide.

3. 20 minutes: access and erasure requests

   What front-line staff may answer and what must go to the privacy contact. No promise to «delete everything tomorrow» when retention duties apply.

4. 20 minutes: cases from your firm

   Two or three short scenarios: a caller asking for a file, a mail with too many recipients, a scan that shows health data on a receipt.

5. 10 minutes: what happens next

   Where the one-page rule lives, how often you refresh, and that reports are welcome.

Managers often need steps 3 and 5 in more depth: escalation, documentation, and no impossible deletion deadlines promised to customers.

How often to run it

At hire, when roles change, after a near-miss or real breach, and on a rhythm management can defend to insurers or customers. Many SMEs repeat annually or every two years. After an insurer questionnaire or a customer audit, a refresher for one department often beats sending the whole company through the same deck again. A one-off from 2019 does not answer an auditor asking what you did after the revised FADP in 2023.

Who should attend

Everyone who touches personal data should attend at least once: not only HR. Include reception, customer service, project staff who receive exports, and anyone who approves marketing lists. IT partners do not replace employee training; they secure systems, while staff decide what leaves the inbox.

• Reception and customer service

  Verify identity, do not read files aloud on the phone, route requests to the right person.

• HR and payroll

  Applications, sickness certificates, safe attachments, no copies in private cloud accounts.

• Finance

  Invoice data, payment advice, shared folders with client documents.

Live session or e-learning

For 20 to 250 staff, a live data protection workshop of one to two hours with examples from Swiss office life often beats a generic slide deck. Many firms combine the two: e-learning at hire, a live session every twelve to twenty-four months for everyone, plus a short module for the affected department after a breach.

Aurum offers a 30-minute needs conversation, a live session of one to two hours, and a follow-up call, remotely or on site in Switzerland, in German or English. Content per the offer: the FADP and GDPR in daily work, what is allowed and what is not, handling personal data, and breach reporting duties. The session targets everyday practice, not certification preparation.

Proof for auditors and customers

Document who attended, the date, topics and language. Auditors and corporate customers ask for that record more often than for a policy PDF nobody read.

• Attendance list or LMS export with date
• One-page summary of modules and roles covered
• Version of the privacy notice you pointed to
• Internal reporting path (named contact, not only «email HR»)

Managers who need the FDPIC path in more detail can pair this with reporting a breach to the FDPIC. Everyday mistakes are covered in email sent to the wrong recipient.

Who can wait

A three-person firm with almost no customer data beyond invoices at the fiduciary may need a short briefing, not a full programme. A recruitment agency, practice or fiduciary with sensitive files should not skip training because «we trust our people».

Cyber insurers and supplier audits often ask about training and its proof. What wording a given insurer requires sits in that insurer’s application or policy documents and was not checked here. It still pays to know which modules you last ran and where the attendance list lives before the form arrives. Customers certified to ISO 27001 expect a running programme with evidence under control A 6.3. That is a different question from «we showed a PowerPoint once».

What training does not do

It does not replace a processing agreement with your IT partner. It does not satisfy the BACS cyber reporting duty for critical infrastructure. It does not protect managers from intentional misconduct; fines up to CHF 250’000 under the FADP target natural persons and require intent (FDPIC on penalties).

A made-up example: after a wrong send

A made-up example: an HR generalist in a 35-person logistics firm sends applicant CVs to a supplier by mistake. Nobody reports to management for two days. After the incident they book data protection training for HR and team leads: safe attachments, internal escalation within one hour, and documentation even when the FDPIC is not notified. Finance joins the last thirty minutes for customer data in invoices. Attendance is logged with topics covered. The insurer questionnaire the next year gets a one-page summary instead of «we will do something».

Measuring whether it worked

You do not need a secret phishing score to see progress. Track whether incident reports rise after training because people trust the path, whether repeat wrong sends drop in HR and finance, and whether new hires can name the privacy contact. Deloitte’s 2026 figures show regular training is already common in medium SMEs; the gap is quality and proof, not whether anyone ever booked a course.

For a live session aimed at Swiss SMEs, see data protection awareness training: the FADP and GDPR in daily work, handling personal data and breach awareness in one to two hours after a short needs call.