What DSG is (and how it’s referenced)

The DSG is the German abbreviation for Switzerland’s data protection law. In English contexts, you’ll often see it referenced as the Swiss Data Protection Act or the Federal Act on Data Protection (FADP). The current, fully revised act entered into force on 1 September 2023 together with implementing ordinances.

The purpose of the DSG is to protect the personality and fundamental rights of natural persons whose personal data is processed. Compared with older Swiss law, the revised DSG strengthens transparency, modernizes key definitions, and adds clearer obligations for businesses.

Common terms you’ll see

• Controller: decides why and how personal data is processed.
• Processor: processes data on behalf of the controller (e.g., SaaS vendor).
• Sensitive personal data: includes categories like genetic/biometric data (and other high-sensitivity categories) with stronger safeguards.
• Profiling / high-risk profiling: automated processing that evaluates personal aspects; “high-risk” triggers stronger requirements.

Scope: who must comply

DSG applies broadly to the processing of personal data of natural persons by private organizations and federal bodies. In practice, any business operating in Switzerland—or serving Swiss customers—should treat DSG as a baseline requirement.

Typical scenarios

• Swiss company processing customer, employee, or supplier data
• Foreign company offering services to Switzerland and processing Swiss personal data (often requiring local representation depending on the setup)
• Organizations using third-party processors (cloud, CRM, analytics, payroll)

Core obligations under the DSG

DSG compliance is a set of operational controls. The strongest approach is to map obligations to your data lifecycle: collect → use → share → store → secure → delete.

1) Transparency and information duties

People must be informed about key elements of processing (what you collect, why, who receives it, and cross-border transfers). Practically, this means a clear privacy notice, plus contextual notices where data is collected.

2) Records of processing activities (RoPA)

Maintain an internal inventory of processing: purposes, categories, recipients, retention logic, and security measures. For some SMEs, there can be exemptions if processing presents limited risk—but relying on exemptions without a documented assessment is risky.

3) Privacy by design and by default

Build privacy into systems: minimize data, restrict access, set secure defaults, and avoid collecting “just in case.” This is especially important for product teams and anyone shipping features that collect data.

4) Data security and breach handling

Implement appropriate technical and organizational measures (TOMs). If a data security breach is likely to result in a high risk to individuals, the controller must notify the FDPIC promptly. In certain cases, affected individuals must also be informed.

5) Data subject rights

Expect requests like access, correction/deletion, and (in certain cases) data portability. You need intake channels, identity checks, response workflows, and evidence trails.

6) Cross-border data transfers

When data is disclosed abroad, ensure an adequate level of protection or use appropriate safeguards and contractual measures. Vendor governance matters: you need to know where data flows and under what controls.

7) Sanctions and accountability

DSG includes criminal provisions with potential fines (notably targeting responsible individuals in cases of intentional violations). Regardless of penalties, the operational risk is clear: incidents, loss of trust, and contractual exposure.

How to implement DSG compliance (step-by-step)

Keep it simple: inventory first, then risk, then controls. Most organizations can build a solid baseline in 2–6 weeks.

Step 1: Build your data inventory (what exists)

1. List systems (CRM, HR, cloud storage, analytics, support desk).
2. Map categories of personal data and purposes.
3. Document recipients/processors and cross-border transfers.

Step 2: Define lawful purpose and retention

• Write purpose statements you can defend (“why we need this data”).
• Set retention rules (and deletion triggers) per dataset.
• Align with legal obligations (employment, tax, contractual retention).

Step 3: Vendor and processor governance

• Ensure contracts cover processor obligations, security, and support for requests/incidents.
• Check sub-processors and data locations.
• Define how access is granted and revoked (least privilege).

Step 4: Security controls + incident playbook

• Access control, encryption, logging, backups, and secure configuration baselines.
• Incident triage: severity, “high risk” assessment, notification decision, and evidence retention.

Step 5: Rights handling workflows

• Set intake channels (email/form) and an identity verification method.
• Create a repeatable process: search → export → redact third-party data → respond.
• Track cases and response times with an audit trail.

DSG vs GDPR (practical view)

DSG is often described as “GDPR-aligned” in spirit, but it’s not identical. If you already run a mature GDPR program, your DSG gap is usually around documentation specifics, Swiss expectations for breach thresholds, and how responsibilities are assigned internally.

DSG compliance checklist (copy/paste)

Use this checklist to assess whether your DSG baseline is operational (not just documented).

• We maintain a data inventory (systems, purposes, categories, recipients, cross-border transfers).
• We have an up-to-date privacy notice and contextual notices where data is collected.
• We defined retention rules and deletion triggers for key datasets.
• We have processor/vendor contracts with security and incident obligations.
• We apply privacy by design/default in product and system changes (secure defaults, minimization).
• We run an incident playbook with a “high risk” assessment and notification decision path.
• We can handle access/correction/deletion/portability requests with an auditable workflow.
• We restrict access via least privilege and keep logs for sensitive processing.
• We periodically review and update our records (quarterly or after major changes).

Sources & further reading

Use authoritative sources and keep them updated. Replace or extend this list based on your industry and risk profile.

1. FDPIC / EDÖB — Swiss Federal Data Protection and Information Commissioner
2. SECO SME Portal — New Federal Act on Data Protection (overview)
3. Fedlex — Ordinance on Data Protection (DPO)
4. ISO/IEC 27001 — Information Security Management
5. NIST Cybersecurity Framework

Last updated: February 22, 2026 • Version: 1.0