Data protection for private individuals in Switzerland

Crash course on the Act · Part 9 of 12

Data protection for SMEs: the essentials in practice

Published: 2 September 2024Updated: 2 November 2026

The FADP applies to all private companies, regardless of their size – from the hairdresser’s to the doctor’s practice to the online shop. For you as a customer, this means you have the same rights even when dealing with a small business. There are some relaxed rules for SMEs, but no general exemption.

Where SMEs get relief

  • Records of processing activities: companies with fewer than 250 employees do not have to keep them, as long as they neither process sensitive data on a large scale nor carry out high-risk profiling (Art. 12 FADP, Art. 24 DPO).
  • Data protection advisor: appointing one is voluntary (Art. 10).
  • Impact assessment and reporting obligation only apply where there is a high risk (Art. 22 and 24).

A pragmatic approach in nine steps

  1. Get an overview: what personal data do we have, where is it stored, who has access?
  2. Privacy policy: create or update it (Art. 19).
  3. Check service providers: fiduciary, IT support, cloud or newsletter tool are usually processors; the cooperation must meet the requirements of Art. 9.
  4. Clarify transfers abroad: in which countries is the data stored, and are the conditions of Art. 16 and 17 met?
  5. Implement basic protection: strong passwords, two-factor authentication, updates, backups, encrypted devices (Art. 8).
  6. Plan for access requests: who answers them within 30 days?
  7. Emergency plan for data breaches: who decides whether to report to the FDPIC?
  8. Deletion concept: delete data as soon as it is no longer needed (Art. 6 para. 4) – taking into account statutory retention obligations, such as ten years for business ledgers and accounting vouchers (Art. 958f CO).
  9. Check advertising: newsletters only with consent or under the UCA’s customer exception (see Part 6).

Common pitfalls

  • Copied privacy policies that do not match the company’s own practice.
  • Employees using private messengers or cloud services for customer data.
  • No one being responsible when an access request comes in.

Data protection does not have to be expensive for an SME. What matters is knowing your own data flows and applying the principles of Art. 6 in everyday work.

You can find more information for businesses in the For businesses section.

← Back to overview