Key points at a glance
- The FADP applies to every company, regardless of size - including sole proprietorships.
- If you collect personal data, you must inform the data subjects, for example with a privacy notice on your website (Art. 19 FADP).
- If you entrust data to a software provider, the provider is your processor. This requires a contract, and you must make sure the provider keeps the data secure (Art. 9 FADP).
- In Switzerland, fines of up to CHF 250'000 are generally imposed on the responsible individual, not the company - and only for intentional violations. Only if identifying the responsible individual would require disproportionate effort can the business be fined instead, up to CHF 50'000 (Art. 64 para. 2 FADP).
Who does the FADP apply to?
The FADP applies to all private individuals and companies that process data relating to natural persons. "Processing" means any handling of data: collecting, storing, using, disclosing, deleting. Personal data is any information relating to an identifiable person - including the name and email address of your contact at a business customer.
Sensitive personal data, such as health data, requires particular care (Art. 5 let. c FADP). You handle it sooner than you think: your employees' doctor's notes are sensitive data.
The principles are simple (Art. 6 FADP): process only what you need for a purpose that is clear to the people concerned, keep the data accurate, and delete it as soon as you no longer need it - unless a retention requirement says otherwise, as with accounting records.
Duty to inform and privacy notice
If you collect personal data, you must inform the data subjects appropriately (Art. 19 FADP). At a minimum, you must state:
- who the controller is, with contact details,
- what you process the data for,
- who you may disclose it to (recipients or categories of recipients),
- and, if data goes abroad, to which countries - plus any safeguards you rely on.
In practice, you meet this requirement with a privacy notice on your website, which you can refer to in quotes, forms or emails. You don't have to send it to each person individually, but it must be easy to find. If you use analytics tools, newsletter services or cloud software, include them as well.
Do I have to keep records of processing activities?
In principle, the FADP requires records of processing activities (Art. 12 FADP): an overview of what data you process and why, how long you keep it and how you protect it. Companies with fewer than 250 employees are exempt (Art. 12 para. 5 FADP, Art. 24 of the Data Protection Ordinance (DPO)) - unless they process sensitive personal data on a large scale or carry out high-risk profiling.
So for most sole proprietorships and small SMEs, this requirement does not apply. A short list of what data is stored where is still worth having: it helps a lot if you get a request for information or have an incident.
Example: physiotherapy practice with two employees
Martina runs a physiotherapy practice. She only has two employees, but she constantly processes her patients' health data - sensitive data on a large scale. That's why she keeps records of processing activities. For her office work - invoices, receipts, payroll - she uses software with servers in Switzerland and a data processing agreement.
Software providers as processors
If you store data in cloud software, the provider processes it on your behalf. This is allowed if the provider only processes the data in the way you yourself would be permitted to, and no duty of confidentiality prohibits it (Art. 9 FADP). In particular, you must make sure the provider can guarantee data security. It may only bring in other subcontractors with your prior authorization.
This is governed by a data processing agreement (DPA, AVV). Reputable providers offer one without being asked. Check where the data is stored: if you disclose personal data abroad, the country must provide adequate protection - the Federal Council has confirmed this for many countries; otherwise, you need appropriate safeguards such as standard contractual clauses (Art. 16 FADP).
Data security: appropriate, not perfect
The FADP requires data security appropriate to the risk, through technical and organizational measures (Art. 8 FADP). There's no such thing as perfect security - but a few measures are especially effective in small businesses:
- Two-factor authentication for every login: a stolen password alone is then no longer enough. Passkeys are the most secure option because they don't work on fake login pages.
- Regular, separate backups: a backup stored on the same device won't help against ransomware.
- Encrypt devices and keep them up to date: turn on BitLocker or FileVault, install updates promptly.
- Limit access: everyone sees only what they need for their work - payroll data, for example, shouldn't be visible to the whole team.
- No data in private storage: don't leave exports and copies unencrypted in shared folders or carry them around on USB sticks.
If something does go wrong
If a data security breach is likely to result in a high risk to the data subjects, you must report it as soon as possible to the Federal Data Protection and Information Commissioner FDPIC (EDÖB) (Art. 24 FADP). Reports are made online via the FDPIC's DataBreach reporting portal; what counts as a high risk is explained in its guide on reporting data security breaches (PDF). Unlike in the EU, there is no fixed deadline in hours. You inform the data subjects if this is necessary for their protection or if the FDPIC requests it. A processor must report a breach on its side to you as soon as possible.
Fines: who pays
Unlike in the EU, fines in Switzerland are generally imposed on the responsible individual, not on the company. Only intentional violations are punishable, for example deliberately failing to inform people or providing false information (Art. 60 FADP), or intentionally breaching the duties of care regarding processors, disclosure abroad and minimum data security requirements (Art. 61 FADP). The fine can be up to CHF 250'000. If you take data protection seriously, you have nothing to fear - but you shouldn't ignore it.
How it works in Easly
In Easly, invoices, receipts and personnel files are all in one place - which is why security isn't an add-on at Easly, but the foundation:
- Your own isolated instance: your data lives in a separate application with its own database, storage and key - separate from all other customers.
- Stored encrypted, in Switzerland: database, documents, receipts, personnel files and backups are stored encrypted on servers in Switzerland. Data is always transmitted via HTTPS.
- Two-factor authentication is mandatory: you can't log in without a passkey (for example Windows Hello or Face ID) or an authenticator app.
- Support only with your code: support can only access your instance if you create an access code - valid for no more than 72 hours and revocable at any time. Every action is logged, and you can see the log yourself.
- Daily backup: an encrypted backup every night, with daily backups kept for 14 days, weekly for 8 weeks and monthly for 12 months. You can request a restore directly in Easly.
- Your data belongs to you: the complete export - all data as Excel and CSV, all documents - is available to you at any time.
- Data processing agreement included: IT Services Schneeberger processes your data on your behalf; the data processing agreement (AVV) is part of the subscription. More on this under Security and data.
If you use the AI features, letter mailing or email sending, the data required goes to the provider you chose yourself. List these providers in your privacy notice.
Frequently asked questions
Does my sole proprietorship need a privacy notice?
As a rule, yes. As soon as you collect personal data - through your website, by email or with an order - you must inform the data subjects (Art. 19 FADP). The simplest way is a privacy notice on your website.
As a small business, do I have to keep records of processing activities?
Not if you have fewer than 250 employees and neither process sensitive personal data on a large scale nor carry out high-risk profiling (Art. 12 para. 5 FADP, Art. 24 DPO).
What do I have to do if my laptop is stolen?
Change passwords, block access and check which data is affected. If the device was not encrypted and the breach is likely to result in a high risk to the data subjects, you must report it to the FDPIC as soon as possible (Art. 24 FADP). With device encryption turned on, the risk is usually much lower.
How long do I have to respond to a request for information?
Generally within 30 days (Art. 25 FADP). The information must generally be provided free of charge. An overview of what data is stored where makes responding much easier.
Information as of: see above. Sources: Federal Act on Data Protection (FADP, in force since September 1, 2023, in particular Art. 5, 6, 8, 9, 12, 16, 19, 24, 25, 60 and 61) and Data Protection Ordinance (DPO, Art. 24). This article is not a substitute for legal advice.