What is on a Swiss FADP compliance checklist?

• Map your processing. List what personal data you process, why, about whom, where it is stored and who receives it.
• Keep a record of processing activities (Article 12). Companies with fewer than 250 employees are exempt unless they process sensitive data on a large scale or carry out high-risk profiling (Article 24 of the Data Protection Ordinance).
• Inform data subjects (Articles 19 to 21). Privacy notices name the controller, the purposes, the recipients and any foreign countries the data goes to, and people are told about automated individual decisions.
• Assess high-risk processing (Article 22). Run a data protection impact assessment where processing is likely to pose a high risk, and consult the FDPIC if a high risk remains (Article 23).
• Build privacy in (Article 7). Apply privacy by design and the most privacy-friendly settings by default.
• Secure the data (Article 8). Take technical and organisational measures appropriate to the risk, as set out in the Data Protection Ordinance.
• Bind your processors (Article 9). Processing by a processor needs a contract or a legal basis, and sub-processors need your prior authorisation.
• Check cross-border disclosures (Articles 16 and 17). Disclose abroad only to countries the Federal Council lists as adequate, or with safeguards such as standard contractual clauses.
• Handle access requests (Article 25). Answer within 30 days, generally free of charge.
• Report breaches (Article 24). Notify the FDPIC as soon as possible when a breach is likely to lead to a high risk, and inform the people affected when it protects them.
• Appoint a representative if needed (Article 14). Foreign controllers that process data of people in Switzerland on a large scale and regularly may have to name one.
• Train staff and review the programme regularly.

The FDPIC can investigate and order changes. Criminal fines of up to CHF 250,000 apply to the responsible individuals, not the company, for wilful breaches of duties such as information, access, cooperation, data security or cross-border disclosure (Articles 60 to 66).

In Data Privacy in Acuna GRC, you select the FADP as an applicable privacy law, alone or with the GDPR, and each processing activity carries a legal basis for each. The register exports with its data flows and legal roles, a nine-question screener tells you when a DPIA is required, TIAs record the safeguard for each foreign recipient, and DPAs are generated for processors. Access requests run on a 30-day clock, and breaches record the time the authority was notified. See Data privacy management.