GDPR & nFADP Compliance

EU & Swiss Data Protection Standards

Since 1 September 2023, the nFADP (New Federal Act on Data Protection) aligns Swiss legislation with the GDPR to:

Strengthen personal data protection
Adapt to technological evolution
Maintain data exchange with the EU
Support Swiss competitiveness

Personal data refers to any element that identifies a person directly or indirectly: name, email, phone, IP address, biometric data or browsing behaviour.

Who Is Affected?

Any organisation, in Switzerland or abroad, that processes data of EU or Swiss residents, uses cookies, tracking tools or contact forms, is directly affected.

Compliance Principles

To comply, organisations must:

Obtain explicit consent before any data collection
Allow users to access, modify or delete their data
Secure data through encryption and restricted access
Ensure transparency in data collection and processing

The nFADP extends protection to biometric and genetic data, mandates Privacy by Design and focuses exclusively on natural persons.

Right to erasure, deletion of personal data upon request.
Right to portability, data transfer between platforms.
Right to information, transparency on data usage.
Right to object, refusal of profiling or marketing use.

In the event of a data breach, companies must promptly inform users and apply corrective measures.

Individual Rights

Under the GDPR and nFADP, individuals benefit from:

Obligations for Swiss Companies

Swiss entities processing EU resident data, even as subcontractors, must fully comply with the GDPR. They are required to:

Notify EU partners of any data breach
Obtain informed consent for profiling and marketing
Clearly identify themselves as data controller or processor
Ensure transparency on data storage, use and sharing

Audit data flows, identify what data is collected and why.
Secure storage and transfer, encryption and SSL/TLS connections.
Train employees, cybersecurity and data ethics.
Verify third-party tools, compliant CRM, analytics and cloud services.
Publish a Privacy Policy, detailing cookies, analytics, forms and marketing use.

Practical Implementation

To ensure compliance, companies must:

Recommended Resources

By integrating GDPR and nFADP best practices, businesses ensure legal compliance while strengthening user trust and brand credibility.

DIGITALABS supports SMEs and professionals in implementing these standards: legal compliance, cybersecurity and ethical data management.

Expert consulting in data protection, privacy policy and regulatory compliance.