The revised Data Protection Act has been in force since 1 September 2023, without a transition period. Almost three years later a clear pattern shows in practice: most companies implemented the duties once and never updated them. That is exactly where today's risks arise.
The core requirements are unchanged: a current record of processing activities, transparent privacy notices, defined processes for access requests, contracts with all processors and a working reporting line for data security breaches to the FDPIC.
The first weak point is almost always the record. It was created in 2023, and since then everything has changed: new tools, new cloud services, new AI applications, new recipients abroad. A record that no longer reflects reality does not protect, it simulates safety.
The second weak point is provider contracts. Whoever has personal data processed by third parties needs the contractual guarantees of Art. 9 FADP. In practice these contracts are missing surprisingly often, or they no longer cover the services actually purchased. Particularly critical: cloud and AI services processing data outside Switzerland, which additionally need a basis for cross-border disclosure under Art. 16 et seq. FADP.
The third weak point is the incident process. A data security breach must be reported as quickly as possible where a high risk for the affected persons is likely. Whoever only sorts out during the incident who decides internally and what gets reported loses exactly the time the law does not grant. Add the FADP's criminal sanctions: fines up to 250,000 francs target the responsible individuals, not only the company.
Our recommendation is a compact data health check of two to three days: align the record with reality, review the provider list and contracts, clarify cross-border disclosures, run the reporting process once. The effort is modest, the effect large, especially before AI projects reshape the data landscape further.
As a first step you can close the most common contract gap yourself with our data processing addendum. For the check and the trickier questions we are happy to assist.
