Data protection for Swiss SMEs 2026: FADP duties, data protection officer, DPIA and breaches

A Swiss SME does not have to appoint a data protection officer: private controllers may appoint one (Art. 10 para. 1 FADP), and only federal bodies must (FDPIC). Every company must, however, secure its data, inform data subjects, answer access requests within 30 days and report serious breaches. The record of processing activities usually falls away below 250 employees (Art. 24 Data Protection Ordinance). A wilful breach can cost the responsible person a fine of up to CHF 250 000 (Art. 60–63 FADP).

Key facts

• The revised FADP has applied since 1 September 2023 and protects only natural persons, including your contacts at business customers (Art. 1, 2 and 74 FADP).
• The officer is optional; once notified to the FDPIC, you may skip consulting the FDPIC despite a high residual risk (Art. 10 and 23 para. 4 FADP).
• No record of processing below 250 employees on 1 January, unless you process a large volume of sensitive data or carry out high-risk profiling (Art. 24 Ordinance).
• A data protection impact assessment precedes any processing likely to be high-risk and is kept for two years after it ends (Art. 22 FADP, Art. 14 Ordinance).
• A breach likely to cause a high risk is reported to the FDPIC "as quickly as possible", not within 72 hours (Art. 24 FADP).
• Access requests get a free answer within 30 days; if the effort is disproportionate, a contribution of at most CHF 300 is allowed (Art. 18 and 19 Ordinance).
• Data may flow without further safeguards to the EU, the United Kingdom or certified US companies; the list is in Annex 1 of the Ordinance.
• Fines of up to CHF 250 000 target the responsible person; the company only up to CHF 50 000 (Art. 64 FADP).

Duties at a glance: who, when, which sanction

What each duty requires of a private SME and what a wilful breach costs. Where no fine is set, the FDPIC can order administrative measures (Art. 51 FADP).

Source: Federal Act on Data Protection SR 235.1 (as at 7 July 2025) and Data Protection Ordinance SR 235.11 (as at 1 December 2025); English versions are unofficial translations.

Does the FADP apply to your SME?

Yes, as soon as you process information relating to an identified or identifiable natural person (Art. 5 let. a FADP). The federal SME portal notes that the new Act, in force since 1 September 2023, imposes additional obligations on companies (SME portal). The Act also covers facts that occur abroad but have an effect in Switzerland (Art. 3 FADP).

Controller or processor

The controller decides on the purpose and means; the processor processes on its behalf (Art. 5 let. j and k FADP). Your SME is the controller for customer and staff data; payroll software, cloud storage and your fiduciary are usually processors. The distinction decides who informs, who answers access requests and who reports a breach.

Sensitive personal data

Six categories need extra care: religious, philosophical, political or trade-union views; health, intimate sphere, racial or ethnic origin; genetic data; biometric data that uniquely identifies a person; administrative and criminal proceedings or sanctions; social assistance measures (Art. 5 let. c FADP). Medical certificates in staff files belong here. Where consent is required, it must be express for such data (Art. 6 para. 7 FADP).

Principles rather than consent

The FADP does not require consent for every processing activity. It requires lawfulness, good faith, proportionality, a recognisable purpose, accuracy and destruction or anonymisation once the purpose is achieved (Art. 6 FADP). How long is "necessary" often follows from other laws: the FDPIC cites ten years for accounting records under Art. 958f CO (FDPIC FAQ).

Data protection officer: optional, but useful

The officer is the contact point for data subjects and authorities, trains and advises the company and supports the application of the rules (Art. 10 para. 2 FADP). The FDPIC stresses that, unlike under the GDPR, the appointment is optional for private parties (FDPIC). Guides that require every SME to appoint an officer repeat the European rule, not the Swiss one.

The four conditions for the relief

The benefit applies only if the person meets four conditions (Art. 10 para. 3 FADP):

1. They act independently in professional terms and without instructions.
2. They carry out no incompatible activities.
3. They have the necessary expertise.
4. The company publishes their contact details and notifies them to the FDPIC.

According to the FDPIC, membership of the executive board or a role in HR or IT management is incompatible, for example; combining the role with information security is possible (FDPIC). Notification is made on the FDPIC portal for data protection officers, with an AGOV login or CH-Login.

What you owe the officer

You provide the necessary resources, access to documents, records and personal data, and the right to inform the board or top management in important cases (Art. 23 Ordinance). The role can be outsourced, shared among several people or given to a legal entity; Swiss residence is not required (FDPIC FAQ). Responsibility for compliance stays with the company.

Detailed answer (in German): Muss ein KMU einen Datenschutzberater ernennen?

Record of processing activities

The record lists which data you process and why. The controller's record contains at least seven items (Art. 12 para. 2 FADP): identity of the controller, purpose, categories of data subjects and data, categories of recipients, where possible retention period and security measures, and, for disclosure abroad, the country and the safeguards. Processors keep their own, shorter record (Art. 12 para. 3 FADP). Only federal bodies notify theirs to the FDPIC.

The SME exemption

The Federal Council implemented the exception in Art. 12 para. 5 FADP through Art. 24 of the Ordinance:

Source: Art. 24 Ordinance (as at 1 December 2025).

Only 1 January counts: a company that passes 250 during the year stays exempt until the next 1 January. Exempt companies must still inform, answer access requests and secure data, as the FDPIC points out (FDPIC FAQ).

Detailed answer (in German): Was muss das Verzeichnis der Bearbeitungstätigkeiten enthalten?

Processing regulations and logging

If you process a large volume of sensitive data by automated means or carry out high-risk profiling, you also need processing regulations covering organisation, procedures and security (Art. 5 Ordinance). In the same cases, if preventive measures are not enough, you log storage, changes, disclosure, deletion and access; logs are kept for at least one year, separately from the system (Art. 4 Ordinance, wording in force since 1 December 2025).

Data security, privacy by design and processors

Data security affects every SME, and breaching its minimum requirements is a criminal offence (Art. 61 let. c FADP). You determine the protection needs by type of data and scale of processing, assess the risk, choose measures according to the state of the art and the costs, and review all of this throughout the processing (Art. 1 Ordinance).

Source: Art. 1–3 Ordinance (as at 1 December 2025).

Data protection by design and by default

You design systems from the planning stage so that the principles are met, and set defaults so that only the minimum needed for the purpose is processed (Art. 7 FADP). In practice: few mandatory form fields, newsletter boxes left unticked, deletion periods configured in the system.

Using processors correctly

You may assign processing if the provider processes the data only as you could yourself, no confidentiality duty prevents it and you have made sure it can guarantee data security (Art. 9 FADP). Sub-processors need your prior authorisation; with a general authorisation, the provider informs you of each change and you may object (Art. 7 Ordinance).

Disclosure of data abroad

Cloud, newsletter tool, video calls: almost every SME discloses data abroad. The FADP offers three routes (Art. 16–17 FADP).

Source: FADP Art. 16–17 (as at 7 July 2025), Ordinance Annex 1 (as at 1 December 2025).

Annex 1 has 44 entries and is reviewed periodically (Art. 8 Ordinance). Check that a US provider's certification actually exists; otherwise you need standard clauses. Your privacy notice names the countries and safeguards (Art. 19 para. 4 FADP).

Duty to inform and automated individual decisions

At each collection, you state at least your identity and contact details, the purpose and the recipients; for third-party data also the data categories; for disclosure abroad the country and safeguards (Art. 19 FADP). For data obtained from third parties, you inform within one month at the latest. The information must be precise, transparent, intelligible and easily accessible (Art. 13 Ordinance): in practice, the privacy notice on your website plus short notes in forms. The duty does not apply, among other cases, if the person already has the information or the processing is provided for by law (Art. 20 FADP).

Automated individual decision

A decision is an automated individual decision when a system decides alone and the decision has a legal effect or significantly affects the person (Art. 21 para. 1 FADP). Typical SME cases: an online shop that refuses purchase on invoice after an automatic credit check, or a recruiting tool that rejects applicants without human review. You inform the person, let them state their position on request and have a human review the decision if they ask (Art. 21 para. 2 FADP). There is no duty if the request is granted under a contract or the person has expressly consented (Art. 21 para. 3 FADP). Credit data must be no older than ten years and concern adults only (Art. 31 para. 2 let. c FADP). Detailed answer (in German): Muss man Betroffene über eine automatisierte Einzelentscheidung informieren?

Impact assessment and FDPIC consultation

The data protection impact assessment comes before any processing that may result in a high risk, particularly with new technologies (Art. 22 para. 1–2 FADP). The Act cites extensive processing of sensitive data and systematic monitoring of extensive public areas. It has three parts: a description of the processing, an assessment of the risks and the protective measures (Art. 22 para. 3 FADP). Similar operations may be assessed together.

Exempt are controllers legally required to process the data, those using a certified system and those following a code of conduct submitted to the FDPIC and based on an impact assessment (Art. 22 para. 4–5 FADP). Certification under Art. 13 FADP is therefore the only data protection audit to which the Act attaches a legal effect; there is no general audit duty.

If a high risk remains despite the measures, you obtain the FDPIC's opinion in advance. The FDPIC replies within two months, or three for complex processing (Art. 23 para. 1–2 FADP). If you have consulted a notified data protection officer, this step falls away (Art. 23 para. 4 FADP). The assessment is kept for at least two years after the processing ends (Art. 14 Ordinance).

Data breach: notifying the FDPIC and informing data subjects

A breach of data security means personal data is lost, deleted, destroyed or altered accidentally or unlawfully, or disclosed to unauthorised persons (Art. 5 let. h FADP). Stolen laptop, misaddressed payslip, ransomware: all breaches. Only a breach likely to cause a high risk must be reported (Art. 24 para. 1 FADP).

How the FDPIC assesses high risk

The FDPIC guide (version 1.2 of 23 April 2025) looks at the sensitivity of the data, the nature and motives of the attack, the effort needed to identify people, volume and duration, financial harm and vulnerable persons. Copies of identity documents and credit card details can create a high risk without being sensitive data. Effectively encrypted data counts as anonymous for third parties, so no report is needed. With ransomware, a high risk must be presumed at the first analysis depending on the circumstances; you may not wait.

What the report contains

Source: Art. 15 Ordinance (as at 1 December 2025).

You report through the FDPIC's online form (DataBreach), which issues a downloadable confirmation; missing details follow as quickly as possible. Every breach, even one not reported, is documented with facts, effects and measures, and the documentation is kept for at least two years from the report (Art. 15 para. 4 Ordinance). Your processor must tell you about every breach, regardless of risk (Art. 24 para. 3 FADP). You inform data subjects if their protection requires it or the FDPIC asks. A report may be used in criminal proceedings against the person who made it only with their consent (Art. 24 FADP). Detailed answer (in German): Wann und wie schnell muss eine Datenpanne dem EDÖB gemeldet werden?

Right of access and other data subject rights

Anyone can find out whether you process data about them. You provide at least your identity, the data itself, the purpose, the retention period, the origin, any automated individual decision and its logic, and the recipients (Art. 25 para. 2 FADP). If you hold no data, you still reply with a negative answer (FDPIC FAQ).

Deadlines and costs

The request is made in writing; you identify the person by appropriate means (Art. 16 Ordinance). You answer within 30 days of receipt, or say within that period when you will answer (Art. 18 Ordinance). Access is free (Art. 25 para. 6 FADP). If the effort is disproportionate, you may ask for a contribution of at most CHF 300; the person then has ten days to reconsider, and the 30 days start only afterwards (Art. 19 Ordinance). If you refuse or restrict access, you give the reason (Art. 26 para. 4 FADP).

Data portability, correction, deletion

Data the person gave you and that you process by automated means is handed over free of charge, on request, in a commonly used electronic format (Art. 28 FADP). Incorrect data must be corrected; in court, the person can demand deletion or a ban on processing (Art. 32 FADP).

Penalties and FDPIC powers

The FDPIC investigates ex officio or on a report (Art. 49 FADP). It can order processing to be adjusted, suspended or stopped and data to be deleted, and require an impact assessment, a consultation, a notification or information (Art. 51 FADP). It does not impose fines; cantonal criminal authorities do so after a conviction (Art. 65 FADP, FDPIC FAQ).

Source: FADP Art. 60–66 (as at 7 July 2025).

Only wilful conduct is punishable. Prosecution is time-barred after five years (Art. 66 FADP).

Worked examples

People and figures are fictitious; deadlines follow the FADP and the Ordinance.

Example 1: Sandra, Winterthur, physiotherapy practice, 18 employees

Sandra keeps files on about 2 400 patients. On 1 January 2026 she employs 18 people, fewer than 250. Health data is sensitive, and 2 400 files are a large volume. The exception in Art. 24 let. a Ordinance applies: Sandra must keep a record. Since the files are electronic, she also needs processing regulations (Art. 5 Ordinance).

On 3 February 2026 a former patient requests access. Without a contribution, the deadline is 30 days from receipt: 5 March 2026 (Art. 18 Ordinance). He wants copies of twelve years of treatment, on paper and in two systems. On 5 February, Sandra notifies a contribution of CHF 120, below the CHF 300 cap. The ten-day reflection period ends on 15 February; the 30 days run from then, so the answer is due by 17 March 2026 (Art. 19 para. 3 Ordinance). Without confirmation, the request is deemed withdrawn.

Example 2: Marco, Basel, online shop, 35 employees

Marco sells bike accessories online. His CRM runs at a US provider certified under the Swiss-US Data Privacy Framework, allowed under Annex 1. His US newsletter tool is not certified, so Marco signs standard data protection clauses (Art. 16 para. 2 let. d FADP).

On Monday 9 March 2026 at 7.30, ransomware encrypts his shop server. 12 000 customer records with addresses and order history are affected, and the attackers threaten to publish them. Following the FDPIC guide, a high risk must be presumed: Marco reports the same day on DataBreach the nature, time, approximate number of records and persons, consequences, measures and a contact person (Art. 15 Ordinance). He keeps the documentation for at least two years, so until at least 9 March 2028.

Failing to report would not have been punishable (FDPIC guide, section 1.8). Wilfully ignoring the minimum security requirements, for instance leaving known critical gaps open (Art. 3 para. 2 let. f Ordinance), is: a fine of up to CHF 250 000 for him personally (Art. 61 let. c FADP).

Example 3: Lukas, St. Gallen, machine building, 248 employees

On 1 January 2026 Lukas' company has 248 employees, fewer than 250, with no large volume of sensitive data and no high-risk profiling: no record required for 2026. In March it hires 15 people, 263 in total. Only 1 January counts; the duty starts on 1 January 2027 if headcount is then at least 250 (Art. 24 Ordinance).

Lukas wants a tool that scores applications and automatically rejects those below a threshold. That is an automated individual decision; a rejection does not grant the request, so the exception in Art. 21 para. 3 let. a FADP does not apply. He informs applicants in the job ad and offers a review by HR. Because the tool combines performance and behaviour traits, he carries out an impact assessment first. If a high risk remains, he consults the FDPIC on 4 May 2026: reply by 4 July 2026, or 4 August 2026 for complex processing (Art. 23 para. 2 FADP). With a notified, independent officer he could skip the consultation (Art. 23 para. 4 FADP).

Special cases

Exactly 250 employees

The Ordinance exempts only companies with "fewer than 250" employees (Art. 24 Ordinance). With exactly 250 on 1 January, you keep a record. The FDPIC FAQ speaks of "more than 250"; the Ordinance text prevails.

Business customers instead of consumers

The FADP does not protect data of legal entities (Art. 1 FADP). But the name, email and phone number of your contact at a business customer are data of a natural person: a purely B2B SME is covered too.

Processing that began before 1 September 2023

Privacy by design, impact assessment and consultation do not apply to processing begun before the Act took effect, as long as the purpose is unchanged and no new data is collected (Art. 69 FADP). All other duties applied immediately.

Lost laptop with an encrypted drive

Effectively encrypted data stays unreadable for the finder; the FDPIC treats it as anonymous, so no report is due (FDPIC guide). Merely pseudonymised data remains personal data. Document the incident anyway (Art. 15 para. 4 Ordinance).

Breach at your provider

The processor reports to you, not to the FDPIC; you assess the risk and report (Art. 24 para. 3 FADP). Require notice without delay in the contract.

Foreign company with customers in Switzerland

A controller without a seat in Switzerland appoints a representative if it offers goods or services there and the processing is extensive, regular and high-risk; all conditions must be met (Art. 14 FADP).

External data protection officer

A law firm or consultancy can take on the role (FDPIC FAQ), provided it is reachable by data subjects and the FDPIC and presents a power of attorney where needed (FDPIC). The independence criteria apply towards each client.

What this means for you

1. This week: check your headcount on 1 January 2026 and the two exceptions in Art. 24 Ordinance.
2. Within a month: list providers with access to personal data and their country; check Annex 1 and US certifications.
3. Within a month: update your privacy notice with countries, safeguards and automated decisions.
4. Within three months: set access rights, encryption, backup and updates in writing (Art. 3 Ordinance).
5. Now: name who assesses and reports a breach on DataBreach, and who answers access requests within 30 days.
6. Before every new tool: check whether an impact assessment is needed, especially for AI, video surveillance and recruiting.
7. Every 1 January: review headcount, record and log retention. Numezis keeps customer, staff and document data with access rights and a change history in one place, which makes the record and access answers easier.

Checklist: data protection in an SME in ten steps

1. Map your data. Customer, supplier, staff and applicant data, with purpose and storage location (Art. 6 FADP).
2. Check the record duty. Headcount on 1 January and the two exceptions (Art. 24 Ordinance); if required, a record under Art. 12 FADP.
3. Decide on an officer. If you expect impact assessments, appoint an independent person and notify them on the FDPIC portal (Art. 10 para. 3 FADP).
4. Review processors. For each provider: contract, security evidence, sub-processors (Art. 9 FADP, Art. 7 Ordinance).
5. Clarify transfers abroad. Check the country against Annex 1, otherwise standard clauses (Art. 16 FADP).
6. Update the privacy notice. Mandatory details, countries, safeguards, automated decisions (Art. 19 and 21 FADP).
7. Set security measures. Access rights, encryption, backup, updates, logs (Art. 3 Ordinance).
8. Impact assessment for new projects. Before any high-risk processing (Art. 22 FADP).
9. Set up breach handling. Internal reporting, risk assessment, DataBreach report, two years of documentation (Art. 15 Ordinance).
10. Access process and deletion periods. Template answer within 30 days and deletion once the purpose is met (Art. 18 Ordinance, Art. 6 para. 4 FADP).

Common mistakes

• Counting on 72 hours. The FADP says "as quickly as possible" (Art. 24 FADP); three days of investigating ransomware is too late, and the FDPIC can order the report (Art. 51 para. 3 let. f FADP).
• Making the CEO the officer. Executive board members are incompatible according to the FDPIC; the consultation exemption falls away and the FDPIC can order the consultation (Art. 51 para. 3 let. e FADP).
• Believing an officer is mandatory. Private parties are free (Art. 10 FADP); spend on data security instead, where breaches can cost up to CHF 250 000 (Art. 61 let. c FADP).
• US tool without certification or clauses. A wilfully unlawful disclosure costs up to CHF 250 000 (Art. 61 let. a FADP).
• Unchecked provider. Assigning processing without checking the provider's security risks up to CHF 250 000 (Art. 61 let. b FADP).
• Incomplete access answer. A wilfully incomplete answer is punishable by up to CHF 250 000 (Art. 60 para. 1 let. a FADP); a negative answer is owed too.
• Assuming the company pays the fine. The responsible person is fined; the company only exceptionally, up to CHF 50 000 (Art. 64 FADP).

Detailed answers

• All Swiss compliance answers, by topic → /en/compliance
• Does an SME have to appoint a data protection officer? (in German) → /de/compliance/datenschutz/datenschutzberater-pflicht-kmu
• When is a data protection impact assessment required? (in German) → /de/compliance/datenschutz/datenschutz-folgenabschaetzung-pflicht
• When and how quickly must a data breach be reported to the FDPIC? (in German) → /de/compliance/datenschutz/datenpanne-meldung-edoeb
• Must data subjects be informed about an automated individual decision? (in German) → /de/compliance/datenschutz/automatisierte-einzelentscheidung

Sources

1. Federal Act on Data Protection (FADP), SR 235.1, Art. 1–33, 49–51, 60–66, 69, 74 — https://www.fedlex.admin.ch/eli/cc/2022/491/en (as at 7 July 2025; unofficial English translation).
2. Data Protection Ordinance, SR 235.11, Art. 1–5, 7–24, Annex 1 — https://www.fedlex.admin.ch/eli/cc/2022/568/en (as at 1 December 2025; unofficial English translation).
3. Code of Obligations (CO), SR 220, Art. 958f — https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en#art_958_f (as at 1 October 2026).
4. FDPIC, Guide on reporting data security breaches and informing data subjects under Art. 24 FADP, version 1.2 — https://www.edoeb.admin.ch/dam/en/sd-web/T64CAUyvAMcF/1_2%20Leitfaden%20des%20ED%C3%96B%20betreffend%20die%20Meldung%20von%20Datensicherheitsverletzungen%20und%20Information%20der%20Betroffenen%20nach%20Art.%2024%20DSG_EN.pdf (23 April 2025).
5. FDPIC, Data protection officer — https://www.edoeb.admin.ch/en/data-protection-officer (2 November 2026).
6. FDPIC, FAQ data protection — https://www.edoeb.admin.ch/en/faq-data-protection (2 November 2026).
7. FDPIC, DataBreach reporting portal — https://www.edoeb.admin.ch/en/databreach-4 (2 November 2026).
8. FDPIC, Reporting portals (DataBreach, officer portal) — https://www.edoeb.admin.ch/en/reporting-portals (2 November 2026).
9. SECO SME portal, Data protection — https://www.kmu.admin.ch/en/data-protection (2 November 2026).