The new Data Protection Act came into force in Switzerland on 1 September 2023.

The revised Data Protection Act and the associated Data Protection Ordinance came into force in Switzerland on 1 September 2023 and are applicable without a transitional period. The new legislation affects all companies in all sectors, but particularly those that manage sensitive, personal customer data, such as fiduciary and IT companies, healthcare practices and property management companies.

What specifically has changed since 1 September?
The most important measures in brief: Since 1 September 2023, the company or organisation must ensure the security of personal data, introduce multi-factor authentication, define super administrators for data processing and implement internal directives and training.

Penalty: Previously, breaches of data protection were considered trivial offences, but now even a breach of the duty to inform is considered a criminal offence.

The privacy policy must be published on the website. This is central. The wording must be precise, transparent, understandable and easily accessible. Data subjects must always be informed about the use of their data BEFORE it is processed. In addition, requests from data subjects regarding data processing must be responded to free of charge and within 30 days ("duty to provide information"). The data must also be transmitted in a commonly used electronic format.

Who does the new data protection law apply to?
The new Data Protection Act only protects natural persons (but no longer legal entities) from misuse, but all companies and individuals who process data are obliged to do so. The law is also applicable worldwide for all situations as soon as they have an impact on Switzerland. The worldwide applicability allows action to be taken against the data hunger of large tech companies such as Alpha (Google), Meta (Facebook), Amazon, etc.

What are the obligations of controllers and processors?
You are obliged to inform customers, interested parties, business partners, employees and website visitors - in short, anyone who entrusts you with personal data (= data subjects) - that and when you collect and process their data. In your privacy policy, you must provide information about the collection, purpose and type of processing of personal data (e.g. profiling).

They are also obliged to inform data subjects of their rights. This includes, for example, the right to request information about the personal data collected or the right to have their own personal data corrected or deleted. They must also show the data subjects how they can exercise their rights and who they need to contact to do so.

What must my privacy policy contain?
The requirements for privacy policies are increasing enormously: this is likely to lead to them becoming too long rather than too short in order to be protected against all eventualities.

The following questions must be answered in the privacy policy in future:

What personal data is collected and for what purpose? How is the user informed about this? How is his or her consent obtained?
Do you use the collected data for marketing measures - possibly through third-party tracking providers, in particular Google Analytics?
How long is the data stored and where? How do you protect the data during storage?
Will the data be passed on? If yes, to whom?
Where do you go with a request for information, deletion, correction or disclosure of data? What information (especially proof of identity) is required?
Do you use automated processes to identify users (profiling) or to derive legally relevant information from the data (e.g. credit score)?
Do you use Google templates on your website or have you integrated Google fonts that allow Google access (downloaded fonts are not a problem)?

How does the new Swiss law differ from the EU GDPR?
If you have already aligned your activities with the EU's GDPR, then that is already a very good thing. It is important to note that commissioned data processing and standard contractual clauses have been subject to the Swiss Data Protection Act since 1 September 2023. In Switzerland, there is now a legal requirement to retain the documentation for notifications made to the FDPIC for 2 years.

Last but not least, a practical tip:
Make your employees aware of data protection confidentiality. Every person who processes data is obliged to comply with the new law and must be able to provide transparency about the use of the data within 30 days upon request and in principle free of charge.

Source: Gryps.ch - 20.05.2023