Data security and data breaches

Even the best data protection concept is of little use if data falls into the wrong hands. The FADP therefore requires everyone who processes personal data to ensure adequate data security.

What the Act requires (Art. 8)

Controllers and processors must use suitable technical and organisational measures to ensure data security that is appropriate to the risk. The Data Protection Ordinance (DPO) sets out the objectives as the confidentiality, availability, integrity and traceability of the data (Art. 1–3 DPO). In certain cases, such as large-scale automated processing of sensitive data, processing operations must be logged (Art. 4 DPO). Typical measures include:

access rights based on the principle of “as much as necessary”,
encryption of devices and data transmissions,
regular backups and software updates,
staff training.

Anyone who intentionally fails to comply with the minimum requirements of the DPO can be fined upon complaint (Art. 61 let. c).

What a data security breach is

A breach occurs when personal data is accidentally or unlawfully lost, deleted, altered or made accessible to unauthorised persons (Art. 5 let. h). Examples include a cyberattack, an email sent to the wrong recipient or a lost, unencrypted laptop.

Reporting to the FDPIC (Art. 24)

The controller reports a breach that is likely to result in a high risk for the data subjects to the FDPIC as soon as possible. There is no fixed deadline in hours as there is in the EU.
The report states at least the nature of the breach, its consequences and the measures taken.
Processors report every breach to the controller without delay.
Data subjects must be informed if this is necessary for their protection or if the FDPIC requests it.

What you can do yourself

If you find out that your data has been affected by a data breach:

Change the affected password, and change it everywhere else you also use it.
Turn on two-factor authentication.
Expect targeted phishing messages referring to the incident.
Check your bank and credit card statements.
Request information about what data about you was stored (Art. 25).

If a company fails to inform you even though there is a high risk, you can report this to the FDPIC.

Read the legal text: Art. 24 FADP – to make a report: Report to the FDPIC.