Crash course on the Act · Part 11 of 12
Learning about data protection: awareness in everyday life and at work
Many data protection incidents do not start with sophisticated technology but with a click on a phishing link, a wrongly addressed email or a password that is too simple. Knowledge is therefore one of the most effective protective mechanisms – at work as well as in private life.
Training as an organisational measure
The FADP does not contain a specific article requiring training. However, companies must use technical and organisational measures to ensure that data protection rules are complied with and that data is secure (Art. 7 and 8). This can hardly be achieved without trained employees. If a company appoints a data protection advisor, training is expressly one of the advisor’s tasks (Art. 10 para. 2 let. a).
What workplace training should cover
- the principles of Art. 6 and what sensitive data is,
- how to recognise access and deletion requests and forward them to the responsible department,
- how to report data breaches internally without delay,
- recognising phishing and fraudulent calls,
- secure passwords and two-factor authentication,
- which cloud, messenger and AI services are permitted for customer data,
- rules for advertising and newsletters.
Short, regular sessions with examples from employees’ own working day have proved more effective than a one-off compulsory event. New employees should be trained early on. If the company documents its training, it can later show that it takes its organisational obligations seriously.
Awareness for private individuals
There is also a lot you can do yourself:
- Be sparing: only provide the data that a service really needs.
- Skim the privacy policy: look out for the purpose, recipients and countries to which data is transferred.
- Check your settings: review visibility and data sharing in apps and social networks.
- Secure your accounts: use a separate password for each account, a password manager and two-factor authentication.
- Stay suspicious: reputable providers never ask for passwords or codes by email or phone.
- Use your rights: an access request shows you what a company actually knows about you.
The Federal Office for Cybersecurity (NCSC) publishes information on current scams, and the FDPIC publishes explanations on data protection.
Put it into practice: create an access request – for businesses: For businesses.