The new Swiss Data Protection Law: Get ready!

On the one hand, the new law was a request from the business community. On the other hand, the revision was necessary to keep up with technological developments. In addition, the new provisions ensure compatibility with European law and are important so that the EU continues to recognise Switzerland as a state with an adequate level of data protection. This will keep the cross-border exchange of data in the future without additional restrictions or requirements.  

The Federal Council decided in August 2022 that the new law will enter into force on 1 September 2023 and will apply from that date. With the transition period of one year until 1 September, companies have been given the time to make the necessary arrangements for implementation.   

In the nFADP, the existing sanctions will be expanded and the maximum fine for violations will be increased from CHF 10,000 to CHF 250,000. However, prosecution and assessment remain the responsibility of the cantons. The penalties will continue to affect natural persons, but in the case of violations of data protection provisions that only affect companies, it is precisely not simple employees but the management that will be held responsible. This means that in principal, the members of an executive body, the management and persons who are actually in charge are primarily responsible.  

With the nFADP, a data protection impact assessment must be carried out whenever a data processing is planned that is likely to entail a high risk for the rights of data subjects. This is the case, for example, if the extensive processing of personal data requiring special protection (e.g. health data) is planned. The data protection impact assessment must describe the planned processing, assess the risks and identify measures to protect the individuals. If the result is that there is still a high risk, an opinion must be obtained from the FDPIC.