The Swiss Federal Act on Data Protection, for GxP IT
Which obligations of the revised Swiss data protection law fall to the IT department of a company licensed by Swissmedic, and how to keep them next to the validation records of the same systems.
The revised law
The Federal Act on Data Protection (FADP) and its Ordinance (DPO) have applied in their revised form since 1 September 2023. They bind companies that process personal data in Switzerland. The Federal Data Protection and Information Commissioner (FDPIC) supervises. The law binds in German, French and Italian; the English text is an unofficial translation.
What falls to IT
A good part of the law is implemented, documented or contracted for by IT.
- Data protection by design and by default (FADP Art. 7), and data security appropriate to the risk (Art. 8, DPO Art. 1–3): access, availability, integrity and traceability
- Logging where large volumes of sensitive data are processed automatically and other measures can't ensure data protection (DPO Art. 4)
- A record of processing activities (FADP Art. 12), with the exemption for smaller companies and its limits
- Processors bound by contract, and sub-processors only with approval (FADP Art. 9)
- Disclosure abroad only to adequate states or under appropriate guarantees (FADP Art. 16, 17)
- Impact assessments before high-risk processing (FADP Art. 22), and breaches likely to lead to a high risk notified to the FDPIC as quickly as possible (Art. 24)
- Requests for information answered within 30 days (FADP Art. 25)
With the GxP Validation Assistant
How the assistant supports it
The act as a rule pack
Each obligation paraphrased with its article, in force, used with the data protection overlay and cited by the Swiss data security procedure.
Records linked to systems
Processing activities, processors, measures, impact assessments, breaches and requests, each linked to the systems it concerns.
Deadlines
Breach notifications, the 30-day answer to a request and the review dates of every record appear on the Today page.
One triage
An incident is assessed once for GxP, security and privacy impact, so a breach is not missed in an IT ticket.
Rule texts are summaries in the product's own words with their articles; the binding texts are published on fedlex.admin.ch. The assistant covers IT's part of data protection; it does not replace your data protection advisor.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.