Overview
The Swiss Federal Act on Data Protection (DSG) governs the collection, processing, and storage of personal data in Switzerland. While similar to the EU GDPR, there are differences in scope, fines, and obligations. Companies need to align internal policies with both frameworks when handling personal data.
Key Differences between DSG and GDPR
- Scope: DSG applies to Swiss-resident data; GDPR applies to EU residents, including data processed outside the EU.
- Consent: GDPR has stricter consent requirements; DSG focuses on lawful processing and purpose limitation.
- Fines: GDPR fines can reach up to €20 million or 4% of global revenue; DSG fines are generally lower.
- Data Protection Officer: GDPR may require a DPO for large-scale processing; DSG only under specific conditions.
- Cross-border transfers: Both require safeguards, but GDPR has stricter international transfer rules.
Company Obligations in Switzerland
Swiss companies must implement technical and organizational measures to protect personal data. Key obligations include:
- Data inventory and mapping (processing activities)
- Privacy notices for data subjects
- Contracts with processors (Data Processing Agreements)
- Incident response and breach notification
- Retention policies and secure disposal
Cross-Border Data Considerations
Organizations handling EU citizen data must comply with GDPR in addition to the DSG. Measures include:
- Standard contractual clauses for international transfers
- Data protection impact assessments (DPIA)
- Privacy by design in system and process architecture
Compliance Tools & Best Practices
- Automated DPIA and processing activity trackers
- Policy templates aligned with DSG and GDPR
- Training and awareness programs for employees
- Audit logs and monitoring of access to personal data
FAQ
Do Swiss companies need to follow GDPR?
Only if they process personal data of EU residents.
What is a Data Processing Agreement (DPA)?
A DPA is a contract between controllers and processors outlining responsibilities and compliance measures.
How often should companies review compliance?
Regularly, at least annually, or when business processes change.