Why it concerns you
The revised Federal Act on Data Protection (nFADP) came into force on 1 September 2023. It applies to any company that processes data about individuals in Switzerland, with no size threshold. An SME that keeps a customer file, sends a newsletter or runs payroll is concerned. Penalties target the individuals responsible, with fines of up to 250,000 francs.
The good news: for an SME, compliance comes down to ten concrete points.
The ten points
- Record of processing. List where your personal data lives: CRM, accounting, payroll, newsletter, website, shared files.
- Privacy policy. Publish on your website what you collect, why, for how long and whom to contact. It must be readable, not copied from a foreign template.
- Basis for each processing. For each use, know why you are allowed to do it: contract, legitimate interest or consent.
- Explicit consent for newsletters. An unticked box, one-click unsubscribe, a record of consent kept.
- Cookies and trackers. No advertising tracker without consent. Strictly necessary cookies do not need it, provided you say so.
- Contracts with your processors. Host, accountant, agency, payroll software: each must sign a data processing agreement and tell you where they host.
- Transfers abroad. An American tool without recognised safeguards is a risky transfer. Prefer hosting in Switzerland or in the European Union.
- Individuals’ rights. A customer can request access to or erasure of their data. You have 30 days to reply: decide who handles it.
- Proportionate security. Unique passwords, two-factor authentication, backups, named access. Nothing exotic, but applied.
- Incident procedure. If data leaks, you must assess the risk and, if it is high, inform the Federal Data Protection and Information Commissioner (FDPIC) and the people concerned without delay. Write the procedure before you need it.
Where to start
Start with the record of processing. In most SMEs it reveals three or four tools that nobody manages, often hosted outside Europe, with shared logins. Fixing those three or four points covers most of the risk.
At C’mon, the question is dealt with upstream: a single platform hosted in Europe, named access and a data processing agreement provided. Our security and data commitments.