How to report a data breach to the FDPIC in Switzerland

How to report a data breach to the FDPIC in Switzerland

You report a data breach to the FDPIC when personal data were lost or disclosed and a high risk for the people concerned is likely. Use the federal portal databreach.edoeb.admin.ch and submit as fast as possible. Switzerland does not give you 72 hours like the GDPR. You document every serious incident internally for at least two years, whether or not you file a report.

This is for management, HR and the privacy contact in a Swiss SME with about 20 to 250 employees. You may be here after a wrong email, a lost device or a ransomware note. It is orientation, not legal advice.

1. Contain

   Stop further loss or access.

2. Assess

   Data types, number of people, likely harm.

3. Document

   Facts, timeline, decisions.

4. Notify FDPIC

   If high risk is likely, via the portal, as fast as possible.

5. Inform people

   When they need to act to protect themselves.

When you must notify the FDPIC

Art. 24 FADP requires the controller to notify the FDPIC when a breach is likely to result in a high risk to the personality or fundamental rights of the data subjects. The FDPIC guide explains factors such as sensitivity of data, ease of identification, severity for the person, and whether the recipient is trustworthy.

You do not notify because a German article says so, or because an insurer form mentions «incident». You notify when Swiss law’s risk threshold is met. If risk is unclear, write down why and ask counsel before you decide to stay silent.

Is every incident a report?

No. A typo in an internal distribution list that never left the company is not the same as a payroll export on a public leak site. The guide asks whether harm to the people concerned is likely and serious. Health data, full identity sets, credentials that still work, and data in the hands of an unknown recipient push toward notification. An encrypted device that never left your control, with no sign of access, may stay in the internal log only. Borderline cases belong in writing, with the reasoning you used at the time.

For the special case of a misaddressed email, see email sent to the wrong recipient. That article walks through recipient type and content, not a generic «always report».

How fast is «as fast as possible»?

There is no Swiss equivalent of the GDPR’s 72-hour rule. «As fast as possible» means once you know enough to describe the breach credibly, without waiting for a full forensic report if people remain exposed. Parallel work is normal: IT contains, management assesses, someone drafts the portal form.

If you need a day to confirm that encryption was intact and the file never opened, use that day. If credentials for customer accounts were posted online, hours matter more than days.

• Swiss timingAs fast as possible

  No fixed hour count in the FADP. Document when you knew enough to report.

• EU parallel72 hours

  Separate duty if GDPR applies to your processing. Not a substitute for the Swiss step.

• Internal logTwo years

  From notification or from the decision not to notify, per Art. 15 para. 4 DSV.

The portal and what to prepare

Reports go through databreach.edoeb.admin.ch. Before you log in, collect:

• Your company as controller, contact person, UID if you have it
• When the breach occurred and when you discovered it
• Categories and approximate number of data subjects
• Nature of the breach (wrong recipient, theft, ransomware, and so on)
• Likely consequences and measures already taken
• Whether you informed data subjects and how

You can update the file when facts change. Keep copies of what you submitted. Save the reference or acknowledgement in the same folder as your internal log. The FDPIC may ask follow-up questions. Your contact person should stay reachable even if the first filing was marked preliminary.

Who prepares the report in the firm?

Many SMEs have no data-protection department. The portal still needs a reachable contact with UID, address and phone. Decide in advance who operates the portal, who briefs management, and who joins customer service or HR when affected people must be told. IT supplies technical facts, HR knows employee lists, finance knows payment data. A short protocol from the last exercise or a near-miss saves hours when the case is real.

If you have never filed, read the guide once and store the portal link in your internal handbook. That does not replace counsel, but you know which fields appear and who signs.

Informing affected people

When the breach is likely to result in a high risk, you also inform the data subjects in a way they understand, unless an exception applies under the Act. Tell them what happened, what data are involved, what you did, and what they can do (change passwords, watch accounts, contact you). A calm factual email from a named person beats a generic template with no phone number.

Internal log even when you do not report

Art. 15 para. 4 DSV requires documentation of breaches, including those not reported, with facts, effects and remedial measures, kept at least two years from notification or from the decision not to notify. Auditors and insurers ask for this log more often than for the FDPIC acknowledgement.

What this is not

Reporting to the FDPIC is not reporting a cyberattack to BACS under the critical infrastructure duty, which applies only to defined operators, not to most SMEs. It is not the same as telling your cyber insurer, though you may need both. It is not a substitute for criminal complaint when theft or extortion is involved.

Who should get help before clicking submit

Firms that process health data, large payroll files, or legal mandates should involve counsel early. Companies that also fall under the GDPR because they offer goods or services to people in the EU may have a parallel EU notification duty. That is a separate analysis from the Swiss portal step.

A made-up example: ransomware with customer export

A made-up example: a metal parts manufacturer with 62 staff near St Gallen. On Sunday night ransomware encrypts a file server. Monday morning production stops. IT disconnects the network segment and finds an exfiltrated zip with 1’400 customer contacts and order history on a leak site listing. No payment is made. By Monday afternoon management knows names, addresses, order values and some delivery notes with phone numbers. High risk is likely because data are public and searchable. They file via the portal Monday evening with «as fast as possible» timing, inform customers Tuesday with reset advice for the web shop accounts, and extend the log entry when the forensic partner confirms scope on Wednesday.

The example is invented. It shows reporting while investigation continues, not after a three-week silence.

Reduce the next incident

Wrong sends and weak access rules cause many SME breaches. After you close the file, schedule training on everyday data handling. Datenschutz awareness training covers FADP and GDPR in daily work, including when to escalate and how reporting duty arises in plain language.