The revised FADP (nDSG), effective September 1, 2023, modernized Swiss data protection law to ensure adequacy with the EU's GDPR framework. Critical for maintaining the EU's adequacy decision that allows seamless cross-border data transfers. Key provisions include strengthened data processing principles (Art. 6), expanded data subject rights including data portability (Art. 28), mandatory data breach notification to the FDPIC within 72 hours (Art. 24), and data protection impact assessments for high-risk processing (Art. 22).
The FADP introduces a risk-based approach mirroring GDPR: organizations must assess the likelihood and severity of risks to data subjects and implement proportionate safeguards. Unlike the GDPR, the FADP does not require a Data Protection Officer (DPO), though organizations may voluntarily designate one (Art. 10). Cross-border data transfers require either an adequacy decision by the Federal Council or appropriate safeguards such as standard contractual clauses (Art. 16-17).
For document-intensive workflows (legal reviews, HR processes, financial due diligence), the FADP's data minimization principle (Art. 6(2)) means organizations should process only the personal data necessary for the defined purpose. When sharing documents externally, anonymization is often the most robust compliance path, eliminating personal data rather than managing it.
DocIQ Shield's zero-persistence architecture is designed with FADP principles at its core. By processing documents entirely in memory with no storage, Shield eliminates the need for data retention policies, storage security measures, and breach notification procedures for document content, because there is no stored data to protect, retain, or report as breached. This architectural choice transforms FADP compliance from an ongoing operational burden into a design guarantee.