Swiss FADP obligations for SMEs: a practical checklist

Swiss FADP obligations for SMEs

Swiss FADP obligations for SMEs boil down to handling personal data lawfully, protecting it with appropriate measures, informing people about processing, and reporting serious breaches to the FDPIC as fast as possible when a high risk is likely. Companies with about 20 to 250 staff are not exempt from the revised Federal Act on Data Protection since 1 September 2023, but many formal tools that large groups use are optional at your size.

This checklist is for owners, HR and the person who handles IT in German-speaking Switzerland. It is orientation, not legal advice. Sector rules, EU customers and employment law can add duties.

• Since1 Sep 2023

  The revised FADP and new ordinance apply to every firm, regardless of headcount.

• RegisterOften optional

  Under 250 staff on 1 January, without large-scale sensitive data or high-risk profiling.

• BreachHigh risk only

  FDPIC notification when personality or fundamental rights are likely at risk, as fast as possible.

• SecurityArt. 8 FADP

  Technical and organisational measures that fit your risk, not a bank manual copied wholesale.

What changed in September 2023

The revised law puts more weight on transparency, security and breach duties. People should understand what happens to their data. They should be told when a breach puts them at high risk. Fines target natural persons who act with intent, not anonymous corporate penalties like under the GDPR.

For an SME that rarely means a new department. It means knowing which systems hold personal data, who has access, which cloud contracts you signed, and how someone reports a mistake without fear.

What the FADP expects in everyday work

The law applies whenever you process personal data about customers, applicants, staff or suppliers. That includes CRM entries, payroll, CCTV at the entrance, marketing lists and files on a shared drive. Principles such as purpose limitation, data minimisation and accuracy are in Art. 6 FADP. Security sits in Art. 8 FADP: technical and organisational measures that fit your risk.

For most SMEs that means access control on cloud accounts, backups, clear roles for who may export data, contracts with IT and SaaS providers, and staff who know how to report mistakes. A written policy helps; silence in the team does not.

• Know which systems hold personal data and review them once a year
• Limit access by role; remove access within days when someone leaves
• Privacy notice on the website and for applicants
• Processor agreements with cloud and payroll partners
• Internal path for incidents with a named owner
• Retention and deletion rules you can explain
• Training or briefing for anyone who handles data

Register of processing activities: often not mandatory

Under Art. 24 of the Data Protection Ordinance, firms with fewer than 250 employees on 1 January are exempt from keeping a full register unless they process sensitive data on a large scale or run high-risk profiling. A recruitment agency, medical practice or insurer may still need one. A typical trading or services firm with 40 staff often keeps a lighter inventory: a spreadsheet of systems, purposes and retention is enough for day-to-day work even if you are exempt from the formal register.

Corporate customers sometimes ask for a register in a supplier questionnaire anyway. You can prepare a simplified version without pretending to be a multinational. Whether a specific contract still demands a full register despite the statutory exemption depends on the wording. We cannot answer that in general here.

When the register exemption no longer applies

Sensitive personal data (health, religion, criminal convictions and similar categories) on a large scale, or automated individual decisions with high risk, can remove the exemption. An office with standard customer files and payroll without health data often stays outside that zone. A clinic that processes patient data daily does not.

If you are unsure whether your firm reaches «large scale», that is a question for counsel, not a blog checklist.

Privacy notice and transparency

People should know who processes data, for what purpose, how long you keep it and who receives it. A privacy notice on the website and a short line in the application process cover most days. It should reflect the revised law, not only the 1992 act.

Breaches and documentation

A data security breach is not always reportable. You notify the FDPIC only when a high risk to personality or fundamental rights is likely, and you do so as fast as possible, not within 72 hours as under the GDPR. You document incidents internally either way, and keep that record for at least two years from notification where applicable (Art. 15 DSV).

Pair this checklist with practical guides on email sent to the wrong recipient and reporting a breach to the FDPIC.

Data subject rights

People may ask what you hold about them, request correction or deletion where the law allows, and object in defined cases. You need a process: who receives the request, how you verify identity, and reasonable deadlines. You do not need a portal; an email to a named contact is fine for many SMEs.

Processors and cloud tools

When a partner processes data on your instructions, Art. 9 FADP expects a contract that covers subject matter, duration, type of data and security. Microsoft 365, payroll bureaus and newsletter tools count. Collect the standard data processing agreements and note where data are hosted.

Cyber incident reporting: usually not your duty

Since 1 April 2025, certain operators of critical infrastructure must report cyberattacks. Most SMEs with 20 to 250 staff fall outside that duty. Your obligations still come from the FADP, not from that reporting regime.

Who is responsible internally

The law does not require every SME to appoint a data protection adviser like a German data protection officer. Someone in the leadership team should own priorities, budget and escalation. HR often handles applicant data; finance handles invoice data; IT or your partner handles access. Document who decides on FDPIC reports.

What you can defer

Full DPIA programmes for every new Excel export, ISO certification, or a 200-page policy nobody reads. Do not defer incident reporting, access removal at offboarding, or telling staff how to escalate a wrong send.

What this checklist is not

It is not a group-wide governance manual. It does not replace counsel for health data, fiduciary secrecy or EU-only processing. It does not list GDPR fines; Swiss fines up to CHF 250’000 apply to natural persons with intent (FDPIC on penalties).

A made-up example: first pass after the revised FADP

A made-up example: a 52-person engineering firm in Aargau. The owner asks HR and the IT partner to list systems with customer and employee data, sign missing cloud contracts, publish an updated privacy notice, and schedule data protection training. They skip a formal register because they are under 250 staff and do not run large-scale health profiling. They add a one-page incident form and name the office manager as first contact. Six weeks later a wrong attachment is reported the same day; they document it and conclude no FDPIC report is needed. The checklist did not finish the job; it gave them a defensible baseline.

First steps this quarter

Confirm cloud DPAs. Update the privacy notice if it still mentions the old law only. Run or book data protection training for employees if the last session predates 2023. Test that offboarding removes mailbox and VPN access within 48 hours.

For a live session on FADP duties in daily office work, see Datenschutz awareness training: one to two hours after a short needs conversation, remotely or on site in Switzerland.