nFADP: the IT measures an SME needs to plan

The new Federal Act on Data Protection (nFADP), the revised Swiss data protection law, came into force on September 1, 2023. It does not impose a list of tools, but it requires technical and organizational measures appropriate to the risk to protect the personal data you process: customers, employees, suppliers.

This article covers the IT side. It does not replace legal advice on questions specific to your business.

What the law requires, in brief

• Data security appropriate to the risk.
• Data protection by design and by default.
• A record of processing activities, from which companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale or carry out high-risk profiling.
• Notifying the Federal Data Protection and Information Commissioner (FDPIC), as soon as possible, of data security breaches likely to result in a high risk for the people concerned.
• Clear rules with processors, including your IT provider and cloud services.
• Safeguards for disclosing data abroad.

Practical technical measures

• Named accounts, multi-factor authentication and role-based access rights, reviewed regularly.
• Disk encryption on laptops and removable media.
• Computers that are protected and kept up to date.
• Regular backups and tested restores.
• Logging of access to sensitive data.
• Rules for retaining data and deleting data that is no longer needed.

Organizational measures

• Knowing where personal data is held: business applications, file shares, Microsoft 365, CRM, e-mail.
• A written procedure for data breaches: who decides, who notifies, and within what time frame.
• A procedure for staff joining and leaving.
• Awareness training for staff.
• Data processing terms with the providers who access the data (in a contract or its general terms).

The hosting question

The nFADP does not require data to be hosted in Switzerland. It allows transfers to countries whose level of protection is recognized by the Federal Council, and provides safeguards for the others. For the United States, companies certified under the Swiss-U.S. Data Privacy Framework are covered.

Hosting in Switzerland does, however, simplify the analysis and often matches what customers expect. In every case, know where your providers store your data and backups.

What about penalties?

The law provides for fines of up to 250,000 Swiss francs, imposed on the responsible individuals in cases of intentional breach of certain obligations. For an SME, the main risk is often the incident itself: business interruption, loss of customer trust, recovery costs.