What Is the Swiss FADP?
The FADP is Switzerland’s Federal Data Protection law for private entities, revised to align more closely with the EU GDPR and the modernized Convention 108. It enforces transparency, accountability, and security in data processing and grants individuals’ stronger rights over their personal data.
Even though Switzerland is not part of the EU, many Life Sciences companies choose to comply with both the FADP and GDPR to ensure uninterrupted operations in the European and Swiss markets.
Even though Switzerland is not part of the EU, many Life Sciences companies choose to comply with both the FADP and GDPR to ensure uninterrupted operations in the European and Swiss markets.
Key FADP Compliance Requirements
• Data Protection Principles: Ensure your processing activities are aligned with these principles, such as lawfulness, good faith and proportionality, purpose limitation and accuracy.
• Transparency: Inform individuals clearly about how their data is collected and used
• Data Subject Rights: Enable access, rectification, deletion, portability and processing restrictions
• Security Measures: Implement technical and organizational safeguards and the principles of data protection by design and by default
• DPIAs: Conduct Data Protection Impact Assessments for high-risk data processing
• Cross-border disclosure: Comply with restrictions for the international transfers of personal data
• Data breach notification: Notify the authority and the affected individuals in case of a personal data breach in accordance with the requirements of the FADP
• Records of processing activities: Controllers and processors shall maintain records with key aspects of their processing activities
• Data Protection Representative: For those controllers with domicile abroad
• Transparency: Inform individuals clearly about how their data is collected and used
• Data Subject Rights: Enable access, rectification, deletion, portability and processing restrictions
• Security Measures: Implement technical and organizational safeguards and the principles of data protection by design and by default
• DPIAs: Conduct Data Protection Impact Assessments for high-risk data processing
• Cross-border disclosure: Comply with restrictions for the international transfers of personal data
• Data breach notification: Notify the authority and the affected individuals in case of a personal data breach in accordance with the requirements of the FADP
• Records of processing activities: Controllers and processors shall maintain records with key aspects of their processing activities
• Data Protection Representative: For those controllers with domicile abroad
What Is a Data Protection Advisor (DPA)?
While the FADP does not mandate the appointment of a Data Protection Advisor (DPA), until certain circumstances it is mandatory. Furthermore, the Federal Data Protection and Information Commissioner (FDPIC) strongly recommends it.
• Liaise with the FDPIC in case of audits or investigations
• Develop and maintain your internal compliance framework
• Promote awareness and training within your teams
• Examines the processing of personal data and recommends corrective measures if a breach of the data protection regulations is established
• Advises the controller on preparing the data protection impact assessment and reviews its implementation
📌 Responsibilities of a DPA:
• Respond to data subject requests in accordance with Swiss law• Liaise with the FDPIC in case of audits or investigations
• Develop and maintain your internal compliance framework
• Promote awareness and training within your teams
• Examines the processing of personal data and recommends corrective measures if a breach of the data protection regulations is established
• Advises the controller on preparing the data protection impact assessment and reviews its implementation
Swiss FADP Services by MyData-TRUST
Swiss FADP Services by MyData-TRUST
• 🧭 Regulatory Gap Assessment
• 📋 DPIAs for high-risk activities
• 🧑💼 Outsourced DPA services
• Data Subjects Requests and Data Breaches Management
• Records of Processing Activities
• Data Protection Representative
• 🎓 Awareness training for your staff
• ⚖️ Legal support and documentation review
We work hand-in-hand with your teams to implement efficient, compliant, and risk-based privacy practices tailored to the Life Sciences environment.
• 📋 DPIAs for high-risk activities
• 🧑💼 Outsourced DPA services
• Data Subjects Requests and Data Breaches Management
• Records of Processing Activities
• Data Protection Representative
• 🎓 Awareness training for your staff
• ⚖️ Legal support and documentation review
We work hand-in-hand with your teams to implement efficient, compliant, and risk-based privacy practices tailored to the Life Sciences environment.
Why Choose MyData-TRUST?
• ✅ In-house legal and operational experts familiar with Swiss and EU regulations
• 🇨🇭 Experience supporting Life Sciences organizations in Switzerland
• 🔬 Sector-specific services for clinical research, biotech, and pharma companies
• 🔐 Alignment with Human Research Act, Cantonal Data Protection Acts, Convention 108 standards, and Global privacy requirements.
• 🇨🇭 Experience supporting Life Sciences organizations in Switzerland
• 🔬 Sector-specific services for clinical research, biotech, and pharma companies
• 🔐 Alignment with Human Research Act, Cantonal Data Protection Acts, Convention 108 standards, and Global privacy requirements.
Frequently asked questions
The FADP is Switzerland’s federal Data Protection law. It applies to any foreign organization that processes the personal data of individuals residing in Switzerland or to companies established in that jurisdiction.
It is optional unless the DPA is granted the authority to assess high-risk DPIAs. However, given the complexity of the data protection landscape in Switzerland in the life science sector, appointing a DPA is strongly recommended. A DPA helps maintain compliance, manage data subject rights, and liaise with the Swiss regulator (FDPIC) and is the point of contact for data subjects.
Both laws enforce transparency, data subject rights, DPIAs, and accountability. However, there are nuances specific to Swiss law that must be considered independently.
We offer external DPA services, gap assessments, DPIAs, legal advice, records of processing activities, and training specific to Life Sciences and Swiss regulatory expectations.
Need more information about MyData-TRUST?
Get in touch with our experts.
MyData-TRUST offers global coverage
Overview of other regional regulations
MyData-TRUST is a company specialized in Data Protection and exclusively dedicated to the Life Sciences industry.
Corporate
