Swiss Data Protection Checklist (revFADP)
A revFADP checklist for Swiss SMEs: records of processing, processors, transfers abroad, privacy notice, access requests and breach reports to the FDPIC.
- Typical schedule annually
- The checklist 6 sections, 25 items
- Variables
{{year}}
Use this checklist once a year to review data protection under the revised Swiss Federal Act on Data Protection (revFADP, also called nFADP or nDSG), which has applied since 1 September 2023. It is written for small and medium-sized companies in Switzerland, and for foreign companies that process data of people in Switzerland. The Federal Data Protection and Information Commissioner (FDPIC) supervises it, and the Data Protection Ordinance (DPO) adds the details.
Who owns it
Management stays responsible, even when tasks are delegated. A privacy contact or data protection advisor runs the review, and system owners confirm the data their tools hold. Adapt this to your jurisdiction and situation; it is a practical checklist, not legal advice.
How it differs from the GDPR
The revFADP follows many GDPR ideas, but the details differ. Data breaches go to the FDPIC "as soon as possible" when they probably lead to a high risk, without a fixed 72-hour deadline. Access requests are answered within 30 days. Companies with fewer than 250 employees are often exempt from keeping a record of processing activities. Fines of up to CHF 250,000 target the responsible individuals who act with intent, not primarily the company. If you also serve people in the EU, run our GDPR checklist as well.
Common pitfalls
- Assuming the GDPR work covers everything. Swiss deadlines, the transfer rules and the reporting threshold are different. Check them separately.
- Forgetting transfers abroad. Cloud tools often store data outside Switzerland. Check each country against the Federal Council list.
- An outdated privacy notice. The duty to inform applies to every collection of personal data, so the notice has to match the tools you actually use.
The checklist: Annual revFADP data protection review {{year}}
Responsibilities
-
Confirm who is responsible for data protection internally and tell staff
-
Decide whether to appoint a data protection advisor and record the decision optional
-
Check whether you need a representative in Switzerland (Art. 14 revFADP) if your company has no seat there optional
Know your data
-
Decide whether you must keep a record of processing activities and record the reasoning
Art. 12 revFADP. Companies with fewer than 250 employees are exempt unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 24 DPO). Many keep a short record anyway, because the other steps depend on it.
-
Update the record of processing activities for
{{year}}, if you keep one -
List new tools and vendors added since the last review
-
Define retention periods and delete data that is past them
-
Check that new systems and features apply privacy by design and by default (Art. 7 revFADP)
-
Carry out a data protection impact assessment for new processing with a high risk (Art. 22 revFADP) optional
Processors and transfers abroad
-
Confirm a written agreement exists with each processor (Art. 9 revFADP)
-
List every country where personal data is stored or accessed
-
Check each country against the Federal Council list of countries with adequate protection (Art. 16 revFADP)
-
For US vendors, check whether they are certified under the Swiss-US Data Privacy Framework
The Swiss-US Data Privacy Framework has applied since 15 September 2024. Without a certification, use other safeguards such as standard contractual clauses.
-
End contracts with vendors you no longer use and confirm the data was deleted
Transparency
-
Update the privacy notice so it matches current purposes, recipients and countries (Art. 19 revFADP)
-
Check that forms, newsletter sign-ups and job applications collect only the data you need
-
Check that the website cookie and tracking setup matches the privacy notice
Access requests and data breaches
-
Confirm the access request process has an owner and a 30-day deadline (Art. 25 revFADP, Art. 18 DPO)
-
Review the requests received in
{{year}}and confirm they were answered on time -
Confirm the breach procedure covers reporting to the FDPIC as soon as possible when a high risk is likely (Art. 24 revFADP)
-
Store the FDPIC contact details and reporting portal with the breach procedure
Security and staff
-
Review technical and organisational security measures and update them
-
Review who has access to personal data and remove access that is no longer needed
-
Train staff who handle personal data, or refresh the training
-
Report results and open actions to management
Checklist as Markdown
Frequently asked questions
Does the revFADP apply to small Swiss companies?
Yes. The revFADP applies to private companies of any size that process personal data. Some duties are lighter for small companies, such as the exemption from the record of processing activities for most firms with fewer than 250 employees, but the duty to inform, data security and the right of access apply to all.
What are the main differences between the revFADP and the GDPR?
Breaches are reported to the FDPIC as soon as possible and only when a high risk is likely, rather than within 72 hours. Access requests have a 30-day deadline. Fines of up to CHF 250,000 are aimed at responsible individuals who act with intent. Many other ideas, such as impact assessments and processor agreements, are similar.
Do Swiss companies also need to follow the GDPR?
They may. A Swiss company that offers goods or services to people in the EU, or monitors their behaviour, can fall under the GDPR as well. In that case it has to meet both laws, and the stricter rule usually decides how a process is set up.
Updated