We keep a GDPR register and a separate one for Switzerland.
Fix: One processing activity carries both laws, with a legal basis for each and a separate basis for special-category data.
See one register for bothSwiss FADP
Swiss FADP compliance software
The FADP and the GDPR ask for the same register. Keep one, for both.
The FADP is Switzerland’s law on personal information. Acuna GRC keeps the list of what you collect and why, under the Swiss law and the European one at the same time, with a legal basis for each on every activity.
1 · TICK YOUR PRIVACY LAWSPrivacy Laws
✓GDPRSelected
✓Swiss FADPProposedSelected
2 · KEEP THE REGISTERApply answers to PA
Activities that need an update41
✓PA-001 · PayrollApproved
✓PA-002 · RecruitmentApproved
3 · WATCH THE CLOCKSPrivacy Dashboard
Access request18 days left
Breach · authority deadline31 h 12 min left
✓DPA · Vireo HR SAActive
What the FADP asks
What does the revised FADP ask of you? Know your data, and act fast on a breach.
The revised Swiss Federal Act on Data Protection has applied since 1 September 2023. It aligns closely with the GDPR but differs in important respects, so each law needs its own reading.
A record of processing
Article 12 asks for a record of processing activities: the categories of data, their recipients and, where possible, how long they are kept.
Breaches reported to the FDPIC
A breach likely to result in a high risk is reported to the FDPIC as soon as possible, and the people concerned are informed when their protection requires it.
Minimum data security
Article 8 sets minimum data security requirements. Breaking them on purpose can be fined, and the fine falls on the people responsible.
Does this sound like you?
Why is the FADP hard to run next to the GDPR? Two registers drift apart.
Most companies under the FADP also process data under the GDPR. Keeping a register for each law doubles the work, and a breach shows quickly which one was out of date.
A breach hit a Swiss company in the news. Would we know what to do?
Fix: The breach wizard records the affected activities, assets and suppliers in one record, and generates the notice for the authority.
See the breach recordNobody owns privacy full time.
Fix: Our Swiss experts offer DPO as a service and run the register, requests and breach response with you.
See DPO as a serviceHow Acuna GRC covers it
What does FADP compliance software need to do? Keep one register, for every law that applies.
You tick the Swiss FADP in Comply, keep one record of processing in Data Privacy, record breaches and requests, collect cookie consent with Cookie Manager and manage processors in TPRM.
01 · Comply
Can the FADP and the GDPR run in one program?
Yes. On the Privacy Laws page in Comply, an administrator ticks the Swiss FADP, and the GDPR if it applies too. The selection sets the legal bases on processing activities, the privacy dashboard figures and the citations on generated documents.
See Comply →02 · Data Privacy
How do we keep the FADP record of processing current?
Each activity maps to one or both laws, with a legal basis for each. A business owner fills it in or answers a questionnaire link, the screener says when an impact assessment is required, and a next review date brings the activity back.
See the privacy management software →03 · Data Privacy
How do we handle a breach and an access request?
The breach wizard records the breach type, the risk to rights and the affected activities, assets and suppliers, then generates the notice for the authority and, when the risk is High, for individuals. Mark supervisor notified records the exact time, and access requests arrive through your Privacy Portal with their own due date.
See requests and breaches →04 · Cookie Manager
Do we need a cookie banner and proof of consent?
Cookie Manager puts a banner on your websites in English, German, French, Spanish or Italian, with Accept all, Reject all and Customize. Every choice becomes a consent record you can search and export.
See Cookie Manager →05 · TPRM
How do we keep track of processors?
Your processors are the third parties you already assess in TPRM, and their supply chain feeds the sub-processor list. Each DPA is generated as a Word document, and the supplier record shows a live DPA status.
See TPRM →Aiko at your pace
Can AI help with FADP work? Aiko tells you what is due.
Ask Aiko which requests are overdue or which activities are due for review. It answers from metadata only, never from a requester’s name, email or message.
1Aiko proposes
Aiko suggestschat_prefBanner only · To review✓PreferencesKeeps the visitor’s chat widget settings✓A suggestion to check before you approve2You confirm
YouApprove into draft✓chat_pref · PreferencesCookies to review323You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Requests and breaches, from metadata
Aiko answers about processing activities, requests, breaches, impact assessments and DPAs and their deadlines, without reading a requester’s name, email or message.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can someone run data protection with us? Yes, our Swiss experts can.
DPO as a service, done for you: our Swiss experts run the register, requests and breach response with you, in Acuna GRC, under the FADP and the GDPR. Your people keep the decisions.
Legal and compliance expert
Laura Menetrey
Swiss FADP and GDPR.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youDPO as a service
Our experts run it. You review.
DPO as a service, done for you
- Keep one record of processing for both laws
- Handle requests and breach response with your team
- Run impact assessments and processor agreements
Integrations
Can Acuna GRC keep our systems and people current? Yes, with 100+ connectors.
Connectors pull data from the identity, HR, cloud and service tools you already run, on a schedule, so the people and systems behind your processing activities stay current.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra Directory
Entra ID
Okta
Google Workspace
Microsoft 365
Personio
AWS
Azure
Google Cloud
Jira
ServiceNow- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC run the FADP? Data Privacy, with the core around it.
The FADP runs in Data Privacy, chosen in Comply next to the GDPR. Cookie Manager keeps the consent records, TPRM brings your processors, and the core keeps findings, risks and assets.
Acuna GRC core
Add-on modules
Swiss FADP connects to
- ComplyTick the Swiss FADP in Privacy Laws
- Data PrivacyOne register for both laws
- Cookie ManagerBanner and consent records
- TPRM (Supplier Shield)Processors and live DPA status
- AssureFindings become Assure issues
- OperateRisks link to activities
- ImplementAssets carry retention fields
- AikoAsk which requests are overdue
FAQ
What else do buyers ask about FADP software?
Does Acuna GRC make us FADP compliant?
No software can. Acuna GRC keeps your records, deadlines and evidence in one place, and responsibility stays with your organization. Our experts can help you run it.
Is the breach clock in Acuna GRC an FADP deadline?
No. The clock in Data Privacy counts 72 hours, the GDPR deadline. The FADP asks for a report to the FDPIC as soon as possible when a breach is likely to result in a high risk, so your team decides the timing it works to. The GDPR 72-hour rule
Do small companies need a record of processing?
Companies with fewer than 250 employees are exempt when they do not process sensitive data on a large scale or carry out high-risk profiling. The record is still the simplest way to know what you hold. What a record of processing activities is
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Working on the FADP? Start with one register.
Bring one processing activity. We record it with you in Acuna GRC under the FADP and the GDPR, and show you how our experts can act as your DPO.
Hosted in Switzerland, the EU or the US