Data Protection Compliance: FADP & GDPR
The FADP applies to personal data processing that has effects in Switzerland, including processing carried out abroad. Araucaria advises Swiss and international businesses on FADP and GDPR compliance, depending on which regimes apply to their activities, and helps coordinate both frameworks where needed.
What We Do
We assess your current situation and put in place a complete compliance program under the FADP and, where applicable, the GDPR. This includes privacy notices, records of processing activities, data processing agreements, internal policies and procedures, employee training and interactive workshops, and broader data governance. We also assist with subject access requests and data breaches.
For international companies, we advise on the FADP, GDPR, or both, depending on their activities, and coordinate the two frameworks to avoid duplication and inconsistency.
FADP and GDPR, Side by Side
The FADP and GDPR share many core principles, but their territorial scope and some compliance requirements differ. The FADP applies to processing that has effects in Switzerland and has Swiss-specific rules on transparency, data breach notification, and representation in certain cases. We identify the differences that matter to your business and build on your existing compliance framework rather than reinventing it.
Whom It Is For
Swiss companies seeking to establish or strengthen their FADP compliance and GDPR compliance, as well as international companies whose activities are subject to the FADP, the GDPR, or both.
Data Protection Training and Workshops
We train teams on the FADP, GDPR, and the data protection issues they encounter in practice. Our training ranges from targeted sessions for specific teams to interactive company-wide workshops, tailored to your business, internal policies, and compliance risks.
AI Governance Programs
Effective AI use requires clear governance, particularly around data, intellectual property, accountability, and internal use. We design practical AI governance programs that build on your existing privacy framework and address the legal and operational risks of using AI. Our combined expertise in data protection and intellectual property allows us to approach AI governance across both areas.
Key Facts
Frequently Asked Questions
We already comply with the GDPR. Is that enough?
Not necessarily. The FADP has its own requirements, including its own transparency obligations, different data breach notification rules, and, in certain cases, the obligation to appoint a Swiss representative.
If we are based abroad, when does the FADP apply to us?
The FADP applies to processing that has effects in Switzerland, even when the processing takes place abroad. This does not mean every global processing activity is subject to the FADP; we identify the activities with effects in Switzerland and address the Swiss requirements that apply to them.
Can you coordinate data protection compliance across multiple jurisdictions?
Yes. Araucaria advises Swiss clients on cross-border data protection matters and coordinates with local counsel where jurisdiction-specific advice is required. We remain involved in the overall project so that the different legal requirements are addressed consistently.
How does the Swiss data protection adviser differ from a GDPR data protection officer?
Unlike the GDPR, the FADP does not impose a comparable general mandatory requirement on private companies to appoint a data protection officer. Swiss law instead provides for a voluntary data protection adviser function, while the GDPR may require a data protection officer in specific circumstances.
Do you provide data protection training and workshops?
Yes. We provide targeted training for specific teams and interactive workshops for wider groups, covering the FADP, GDPR, internal policies, and the data protection issues employees encounter in practice.
Can you assist us with a data breach in Switzerland?
Yes. We assess the incident, advise on containment and documentation, and determine whether notification to the FDPIC or affected individuals is required under the FADP.
Can you help us respond to subject access requests?
Yes. We assess the request, identify the information that must be provided, review any applicable limitations, and help prepare a compliant response within the required timeframe.
What happens if we ignore the FADP?
The FADP provides for criminal fines of up to CHF 250,000, imposed primarily on the natural person responsible for the offense. The FDPIC can also order administrative measures to restore compliance with the FADP.
Book a data protection review for your Swiss activities.