nFADP data processing agreement with your IT provider

Your IT provider manages your computers, your Microsoft 365 accounts, your servers or your backups: it therefore has access to the personal data of your customers and employees. Under the nFADP, it acts as a processor, and the work entrusted to an IT provider must rest on a data processing agreement that sets out what it may do with that data.

You remain the controller: it is up to you to choose a provider able to guarantee data security and to check that the contract provides for it. This article lists the points to review. It does not replace legal advice.

Processors under the nFADP: what the law says

Article 9 of the nFADP allows the processing of personal data to be assigned to a processor, by contract or by law, on three conditions: the processor only processes the data in the way you would be entitled to yourself, no legal or contractual duty of confidentiality prohibits it, and you have made sure it is able to guarantee data security.

The processor may only assign the processing to a third party with your prior authorization. The law sets no template: you and the provider define the content of the contract. It is called a data processing agreement (DPA), a processing contract or a data protection addendum. This framework can be a separate document or be built into the provider's general terms, as long as it covers the points below.

What should the agreement with your IT provider include?

A useful data processing agreement fits in a few pages. At a minimum, it answers these questions:

• Instructions: which data, for which purposes, with the principle that the provider acts only on your instructions.
• Security: the technical and organizational measures applied (access control, multi-factor authentication, encryption, backups, logging).
• Confidentiality: the commitment of the provider's staff who access the data.
• Subprocessors: access to the list of suppliers used (cloud, backup, support tools), at least on request, and the notice and objection procedure when one changes.
• Data location: the countries where the data and backups are stored or accessed.
• Incident notification: the obligation to inform you as soon as possible of any data security breach.
• End of contract: the return of the data in a standard format, then its deletion, confirmed on request.
• Assistance and audit: help in answering requests from data subjects and the possibility to verify compliance with the contract.

Data location and subprocessors

The nFADP does not require data to be hosted in Switzerland. Disclosure abroad remains possible to a country whose level of protection the Federal Council recognizes, or with appropriate safeguards such as standard contractual clauses. You still need to know where the data goes: a local provider may rely on a cloud service, a remote access tool or a backup platform located elsewhere.

Ask for the list of these subprocessors, with the storage country, and how you will be notified of a change. The list also helps you answer a customer who asks where their data is.

Incident notification and end of contract

In the event of a data security breach, you are the one who notifies the FDPIC when the risk to the data subjects is likely to be high. The processor, for its part, must inform you as soon as possible. The contract specifies how: a named contact on each side, the channel used for the alert and the hours during which it is monitored, and the information provided (nature of the incident, data affected, measures taken).

Plan the end of the contract when you sign it. Provide for the return of the data, administrator access and documentation, with the format, the timeframe and what is included or billed, then the deletion of copies held by the provider: within a set period for live data and, in backups, at the latest when their retention period expires. Changing providers then happens without lock-in.

How to review your agreement: the questions to ask

If no document (a separate agreement or clauses in the general terms) governs processing with your provider, or if the existing document predates the nFADP, four steps are enough to put things in order. The questions below serve as a guide.

• Where are our data and backups stored, and from which countries can they be accessed?
• Which subprocessors do you use, and how will we be informed of a change?
• Who on your side has access to our administrator accounts, and is that access logged?
• How quickly and through which channel do you inform us of an incident?
• How do we get our data and access back at the end of the contract?

How SysPros approaches the question

For the personal data it processes on its clients' behalf, SysPros acts as a processor, and this framework is built into its general terms. The backups we operate are stored at three ISO 27001 certified sites in Switzerland (Geneva, Gland and Lucerne); the offer states the applicable storage and access countries. The questions above are part of our discussions before a contract is signed.