For private companies, appointing a data protection officer under the revised FADP is voluntary; only federal bodies are required to appoint one. Anyone processing data of persons in the EU should also check whether the GDPR applies to the specific activity. On top of that come the DPIA, the duty to report data breaches, and the duty for controllers based abroad to appoint a representative. We set out the picture step by step.
In short:
Where a processing is likely to involve a high risk, companies must carry out an impact assessment; if a high residual risk remains, consultation of the FDPIC can be avoided only with an appointed, qualified adviser.
Foreign companies must, under certain conditions, designate a representative in Switzerland; the representative's contact details must be publicly accessible and serve as a point of contact for data subjects and for the FDPIC.
Report a data security breach to the FDPIC if it is likely to result in a high risk; set out the cause, the data affected and the measures taken in advance.
The data protection adviser must be professionally independent; stipulate freedom from instructions, direct access to management and sufficient resources expressly in the contract.
When an appointment is required: revFADP and GDPR compared
The revised FADP does not require private parties to appoint a data protection adviser. Art. 10 FADP only sets out the duty for federal bodies; private parties may appoint one voluntarily. That sounds relaxed, but only at first glance.
What matters is where and for whom you process data:
- Purely domestic activity with no particular risks: no adviser needed. Clear internal responsibilities and sound documentation are enough.
- Business with the EU: check whether the GDPR brings additional requirements for your specific activity.
- High data risk: an adviser becomes a strategic lever, because it can allow the FDPIC consultation on the DPIA to be dispensed with (more on this below).
- Federal bodies: here the duty applies without exceptions.
For your planning this means: first assess your risk, then set out who is responsible internally, and document the decision, even if it goes against appointing an adviser. It is also worth looking at the duties that have applied since the revFADP. An outside view on the importance of the subject is provided by this piece on the significance of data protection.
DPIA: when it is required and how an adviser replaces the consultation
A data protection impact assessment is required where a processing is likely to entail a high risk to the personality or the fundamental rights of the data subjects. Art. 22 FADP ties this to the nature, scope and purpose of the processing. If, despite countermeasures, a high risk remains, Art. 23 requires consultation of the FDPIC.
This is where the exception kicks in: private controllers can forgo this consultation if they have appointed a data protection adviser who meets the requirements of Art. 10(3) FADP. Legal 500's assessment confirms this. The effort therefore shifts: away from the authority and toward a qualified adviser.
How to proceed:
- Describe the planned processing: purpose, data types, scope, recipients.
- Assess the risks to the data subjects and record the measures taken against them.
- Check whether a high residual risk remains.
- Clarify whether an adviser with the necessary qualifications is involved; if not, consultation is due.
- Archive the DPIA together with the basis for the decision.
Pro tip: bring the adviser in before the project starts, not only at sign-off. At that point data flows and risks can still be changed.
How a DPIA is structured in practice is shown in our guide to the data protection impact assessment. The FDPIC explains the instrument on its page on the data protection impact assessment.
Duty to appoint a representative for foreign controllers under Art. 14 FADP
If your company is based abroad and processes data of persons in Switzerland, appointing a representative in Switzerland may be mandatory. The FDPIC sets out the details on the designation of a representative under Art. 14 FADP. The conditions relate, among other things, to regular processing, a high risk and the scope.
The representative has a clear role:
- It is the point of contact for data subjects and for the FDPIC.
- It serves as a domicile for service in Switzerland.
- Its contact details must be publicly accessible.
Make the representative's contact details publicly accessible. Check which further steps are required in your case.
Tasks, requirements and independence of the data protection adviser
The adviser must be professionally competent and free from instructions. The FDPIC states on its page on the data protection adviser: the adviser may not perform tasks that are incompatible with this role. The contact details are to be published and may be notified to the FDPIC.
Possible everyday tasks are advising the company and contributing to the DPIA.
Check whether further tasks are compatible with the independent role of the data protection adviser. Set the position out in the contract: freedom from instructions in professional assessment, direct access to management, sufficient resources.
Pro tip: record in writing which further functions the adviser performs, and review these annually for conflicts of interest.
Reporting data breaches: duties and procedure in the FDPIC reporting portal
You must report a breach of data security to the FDPIC where it is likely to result in a high risk to the data subjects. The basis is Art. 24 FADP; the details of the content of the report are governed by Art. 15 FADPO. The FDPIC explains practical cases in the DataBreach guide. Further duties on technical and organisational measures are set out in the guide on technical and organisational measures.
The procedure in practice:
- Identify and contain the incident.
- Assess the risk to the data subjects.
- Submit the report through the FDPIC online form.
- File the FDPIC confirmation.
- Inform the data subjects where this is necessary or appropriate.
The FDPIC provides an online form through which you can report data security breaches securely and receive a confirmation. (Source: DataBreach guide)
Prepare a template in advance: time, data affected, suspected cause, measures taken. In an actual incident there is no time to draft from scratch.
When we advise clients to appoint a data protection adviser
In our view an adviser is worthwhile wherever data flows run across borders and languages, for example with group structures that have companies in the EU, in Switzerland and in the East. An adviser can support the legal assessment of such group structures. In incidents, speed matters too: anyone who already knows who reports and what is reported does not lose hours. And communication with authorities and data subjects works better in the right language. For the initial review and DPIA support, we are available.
— Bitblade
Our support for DPO review and DPIA
We work through with you whether you need an adviser, and support you if you appoint one. We assist you directly in communication with a lawyer.
- Data protection check under the revFADP
- Support for the data protection impact assessment
- Advice on the representative and on publishing the contact details
Our process: initial consultation, scoping, offer. The initial consultation starts at CHF 150 per hour. Request your initial consultation now and tell us about your case.
This article contains general information and does not replace advice from a qualified lawyer. Consult a qualified legal professional about your personal situation before acting on the basis of this content.
FAQ
Is a data protection officer mandatory in Switzerland?
For private companies, no; the appointment is voluntary. Federal bodies are required to appoint one. For data processing with an EU link, companies should check whether further requirements apply alongside Swiss law.
What duties does a data protection officer have?
The officer advises the company, monitors compliance with data protection and contributes to the DPIA. The officer must be professionally independent, and the contact details must be published.
Which data protection principles apply in particular?
Lawfulness, transparency, purpose limitation and data security are central. The revFADP also requires, among other things, information duties and technical protection measures.
Is a privacy policy mandatory?
In many cases, yes, because the FADP sets out information duties toward data subjects. A privacy policy can serve to inform data subjects about the processing of their data.