Checklist: 7 Steps to Compliance with the New Swiss Data Protection Act

On September 1, 2023, the new Swiss Data Protection Act (nDSG) took effect. It followed the European Union’s General Data Protection Regulation (GDPR), which was introduced in 2018.

This article explains the changes introduced at that time and their short- and long-term impacts on SMEs. The checklist provides an overview to help companies plan their transition so they can avoid fines and reputational damage, strengthen their customers’ trust, and ensure the free flow of data with the EU.

• Effective as of: September 1, 2023
• Goal: Better protection of personal rights and fundamental rights in the processing of personal data
• Model: The European Union’s General Data Protection Regulation (GDPR) of 2018
• Subject: Primarily businesses and organizations
• Benefits for SMEs: Stay competitive, avoid fines, and strengthen customer trust
• nDSG vs. GDPR: An Overview of the 11 Key Differences
• Practical Help: Privacy Policy Generator; the code onlineKarma10 offers a discount.

The nDSG fully protects the data of natural persons. The data of legal entities is no longer protected by the law to the same extent. The personal rights of a company’s employees remain protected.

Genetic and biometric personal data are considered particularly sensitive personal data and require special care.

Personal data includes, for example, master data such as name, date of birth, or IBAN; activity data from physical and digital tracking; and profiling data used for the automatic analysis of interests, preferences, or performance.

Data that warrants special protection includes, among other things, data related to health, genetic or biometric characteristics, religious, political, or union-related views, as well as data regarding criminal or social measures.

These two principles protect personal data through appropriate technical and organizational measures, as well as through privacy-friendly default settings.

The Data Protection Impact Assessment (DPIA) describes the planned data processing, evaluates risks to the privacy and fundamental rights of data subjects, and sets forth appropriate safeguards.

The obligation to provide information applies to any collection of personal data, not just to data requiring special protection. Data subjects must be informed in an understandable manner about the scope and purpose of the processing—for example, in a privacy policy. Further information is available from the EDÖB.

Identify what personal data you process and which of these categories require special protection. Provide transparent and easy-to-understand information, such as:

• Privacy Policy
• Terms and Conditions or a separate letter
• Consent Form
• Informative cookie banners

Whether consent is required depends on the category of data, the purpose, the technology used, and the applicable law.

The technical design of a product or service must respect privacy. Appropriate measures include:

• Data minimization: Collect only the data that is truly necessary for the purpose.
• Selective password and access protection: Access is limited to employees who need it for their work.
• Data Deletion Policy: Delete personal data after a specified period of time, in compliance with statutory retention requirements.

Privacy-friendly default settings are active without any action required by users and limit data processing to the absolute minimum. Examples include IP anonymization in analytics systems, minimalist contact forms, restricted access to profiles, and app permissions.

Current Note on Cookies: Switzerland does not have a blanket requirement for cookie banners like the one in the EU. However, depending on the technologies used, data categories, target audience, and the applicability of the GDPR, consent may still be required. Please review the specific circumstances of your case.

A data protection impact assessment (DPIA) is required if processing is likely to pose a high risk to personal rights or fundamental rights. The risk may arise, in particular, from new technologies, the nature and scope of the processing, the circumstances, or the purpose of the processing. Examples include the extensive processing of data requiring special protection or the systematic monitoring of publicly accessible areas.

The privacy policy must clearly describe all relevant data processing activities and be easy to find—for example, in the footer. Contact forms should also include a reference to the privacy policy. Important information includes:

• Identity and Contact Information of the Data Controller
• Purpose of Processing
• Recipients of Data Disclosures
• Data Categories for Third-Party Data Collection
• Country Specification for Data Exports

The generator from Datenschutzpartner helps with the creation process. With the code onlineKarma10, customers can save up to 10 percent.

Data controllers and data processors must generally maintain a record of processing activities. An exception may apply to organizations with fewer than 250 employees if the processing poses only a low risk. The record documents the minimum information required by law and should also include the retention period as well as a general description of data security measures.

Data security breaches must be reported to the FDPIC as soon as possible if they are likely to pose a high risk to privacy or fundamental rights. Data subjects must be informed if this is necessary for their protection or if the FDPIC requires it.

Current Note: The former NCSC is now known as the Federal Office for Cybersecurity. Information and reporting options are available from the BACS.

The nDSG provides for criminal sanctions against responsible individuals in the case of certain intentional violations. Depending on the circumstances of the offense, fines of up to CHF 250,000, supervisory investigations by the EDÖB, and civil claims may be imposed.

In particular, breaches of obligations regarding information, disclosure, or data security; inadequate safeguards for cross-border data transfers; and a lack of contractual safeguards with data processors may be relevant.

The specific sanctions that may apply in individual cases and the question of liability depend on the specific circumstances. This overview does not constitute a legal assessment.

The following steps are recommended for a structured implementation:

• Inventory of All Processing of Personal Data
• Risk Assessment in the Company
• Organization of internal processes, clear responsibilities, and minimal access rights
• Review and amendment of privacy policies and contracts with data processors, including the record of processing activities
• Designation of a contact person for data protection matters

These two services can assist you with the practical implementation. Before using them, check whether their features and terms are a good fit for your situation.

You can use the questionnaire from Datenschutzpartner to create a customized privacy policy.

If the website requires a consent banner, Cookiebot can help with setup and management.

• Federal SME Portal: New Data Protection Act
• Federal Data Protection and Information Commissioner
• Bexio: New Data Protection Law
• Hostpoint: The New Data Protection Act
• EQS: Swiss Data Protection Act
• WEKA: Overview of the nDSG
• VISCHER: The New Data Protection Act
• Cookiebot: Data Protection in Switzerland