Insights

infosec

Cyber risks and the board: what a good report must show

A cyber report to the board of directors should prepare a decision, not just show activity. With a one-page template and a fictitious example, you can check whether your current report does this.

infosec

A cyber budget is not cyber oversight: what boards of directors should ask

An approved cyber budget says little about which business risks remain. Five questions help the board of directors turn a budget approval into a traceable decision about risks.

infosec

Cyberattack on a Software Vendor: Why Pension Funds Must Test Their Vendors in Detail

An attack on a software vendor affects several Swiss pension funds. The case is a reason to rethink your own vendor review: why a completed questionnaire alone is not enough and what a review that goes deeper looks like.

datenschutz

Data Protection With AI: Why Checklist Compliance Is Not Security

AI produces a privacy notice, a record of processing and a list of measures in minutes. Whether the data is protected is a different question. Five pitfalls and the difference between a ticked checklist and security that works.

kunstliche-intelligenz

Common AI Data Protection Mistakes That Prove Costly

AI tools are rolled out in days, while data protection is often left for later. That comes at a price: halted projects, lost deals and personal fines. Six common mistakes and how companies avoid them.

kunstliche-intelligenz

EU AI Act for Medical AI, Your Healthcare Action Plan

A practical action plan for the EU AI Act and medical AI: which systems are high-risk, how the AI Act dovetails with MDR/IVDR, and why an inventory and classification now matter more than any deadline.

infosec

The 24-Hour Reporting Duty for Hospitals, ISG/BACS in Practice

What a hospital must report, how the clock runs, what BACS expects, including a reporting workflow to rehearse in a tabletop and the distinction from NIS2.

kunstliche-intelligenz

The EU AI Act for B2B SaaS With AI Features: What to Classify Now

What the EU AI Act means for B2B SaaS providers shipping AI features: transparency duties for most, high-risk for some, GPAI duties for model providers, the provider vs deployer split, and how it interlocks with your DPA and the vendor security review.

infosec

Answer Security Questionnaires Faster: A Trust Center and Answer Library for B2B SaaS

A practical guide for B2B SaaS: answer CAIQ, SIG and bespoke security questionnaires faster, build a trust center, and stop deals stalling in procurement.

infosec

SOC 2 vs ISO 27001 for B2B SaaS: A Decision Guide for Vendor Security Reviews

SOC 2 or ISO 27001 first? A decision guide for B2B SaaS providers who want to answer customer security questionnaires fast and win the deal.

infosec

Choosing a Healthcare Security and Data-Protection Partner, A Decision Guide

A neutral decision guide for hospitals, practices and HealthTech: which criteria matter when choosing a security and data-protection partner, with a buyer's checklist.

datenschutz

Processing for B2B SaaS Vendors – GDPR Art. 28, the Swiss DSG and the DPA Customers Demand

Legal guide for SaaS vendors as processors: GDPR Art. 28, Swiss DSG, the DPA, sub-processor list, ROPA Art. 30(2), Art. 32, 72h notice, SCCs and TIA. With a checklist.

infosec

Supply-Chain and Third-Party Risk in Healthcare – The Hospital Blind Spot

Cloud, EHR and MedTech suppliers are part of your liability: due diligence, risk tiering, contractual controls, DPAs, ISMS integration (A.5.19–A.5.23) and continuity escrow.

alle

FINMA Risk Monitor 2024: Cyber Threats and Market Volatility in Detail

The FINMA Risk Monitor 2024 is the annual situational assessment by the Swiss Financial Market Supervisory Authority. It prioritises cyber risks, third-party dependencies and market volatility as central supervisory focus areas for 2025.

infosec

You Don't Treat Your Own Toothache – So Why Treat Your Own Cyber Risk?

Sick → doctor. Taxes → accountant. Machine down → technician. Cyber attack → "our IT guy handles that." Why that one reflex is the most expensive line in your P&L.

kunstliche-intelligenz

High-Risk AI Systems, How to Tell If You're In Scope

When is an AI system high-risk under the EU AI Act? Annex III with examples, the Art. 6(3) derogation and the roles from provider to deployer.

kunstliche-intelligenz

AI Act × DSG × GDPR, Where Three Regimes Overlap

How the AI Act, FADP and GDPR interact: scope, transparency, DPIA and FRIA, automated individual decisions, data governance and supervision.

kunstliche-intelligenz

Prohibited AI Practices Under the AI Act, Examples for Swiss SMEs

Which AI practices Art. 5 of the EU AI Act prohibits, explained with examples from Swiss SMEs: manipulation, social scoring, emotion recognition, biometrics.

kunstliche-intelligenz

AI Policy Template for Swiss SMEs

AI policy for Swiss SMEs: scope, approved tools and data, prohibited use cases, human oversight, suppliers and training.

kunstliche-intelligenz

AI Regulation Switzerland, 2026 Status and Outlook

AI regulation in Switzerland: the Federal Council's sectoral approach, the Council of Europe AI convention, FDPIC positions and the effect of the AI Act.

infosec

Building an ISMS, Step-by-Step to ISO 27001

Building an ISMS under ISO/IEC 27001 in twelve steps: scope, gap analysis, risk assessment, SoA, controls, internal audit and certification audit.

datenschutz

Setting Up Calendly in a GDPR/DSG-Compliant Way

Using Calendly in line with data protection law: data flows of a booking, DPA and third-country transfers, key settings, cookies and alternatives.

kunstliche-intelligenz

ChatGPT Business and Data Protection: What Swiss Employers Need to Regulate

Can a Swiss SME use ChatGPT Business with personal data? Conditions under the FADP, comparison with personal accounts, Enterprise and API, checklist, policy.

datenschutz

Cookie Banner Switzerland: DSG-Compliant Setup (Templates)

Cookie banners for Swiss websites: how the TCA, FADP and UCA interact, when opt-in makes sense, three banner templates and common mistakes.

datenschutz

Cookie Banners & Tracking: DSG Obligations in Detail

Cookies and tracking in Switzerland: the legal bases, when consent is needed and when information is enough, and what a cookie notice must contain.

infosec

Cyber Security Switzerland, Consulting, Audits, Awareness

How cyber security consulting is structured in Switzerland: assessment, ISMS, penetration tests, awareness and incident response in five phases.

infosec

Cyber Security for Swiss Companies, The 2026 Guide

Cyber security guide for Swiss companies: threat landscape, ISA and the reporting duty, NCSC, CIS Controls, incident handling and priorities.

datenschutz

Reporting a Data Breach to the FDPIC, 5-Step Guide

Reporting a data breach to the FDPIC in five steps: detection, assessing the high risk, notification under Art. 24 FADP and informing data subjects.

datenschutz

Data Protection in Aargau

Data protection in the canton of Aargau: the IDAG for public bodies, the FADP for private companies, the cantonal authority and advice for SMEs.

datenschutz

Data Protection in Basel-Stadt

Data protection in Basel-Stadt: the IDG BS for public bodies, the FADP for private companies, the life sciences cluster and cross-border commuters.

datenschutz

Data Protection Bern, DSG and Cantonal KDSG

Data protection in the canton of Bern: the cantonal KDSG for canton and municipalities, the FADP for private companies, supervision and practical advice.

datenschutz

Data Protection Geneva, Cantonal LIPAD and Federal DSG

Data protection in the canton of Geneva: the LIPAD for public bodies, the FADP for private companies, cantonal supervision and international organisations.

datenschutz

Data Protection for Hotels and Hospitality

Data protection in hotels and restaurants: guest data and registration duties, PMS, payment data, marketing and loyalty, video and staff data.

datenschutz

Data Protection for Insurers and Brokers

Data protection for insurers and brokers: application and claims data, profiling and AI in underwriting and pricing, FINMA requirements and data flows.

datenschutz

Data Protection for Law Firms, Attorney–Client Privilege × DSG

Data protection in law firms: legal privilege and the FADP right of access, cross-border disclosure, cloud hosting of client files and data breaches.

datenschutz

Data Protection in Lucerne

Data protection in the canton of Lucerne: cantonal law for public bodies, the FADP for private companies, tourism, municipalities and universities.

datenschutz

Data Protection Officer in the Canton of Zurich

External data protection officer in the canton of Zurich: FADP and IDG ZH, industries with demand, tasks in a mandate, interfaces and engagement models.

datenschutz

Data Protection Officer, When Does My Company Need One?

When does a company need a data protection officer? Mandatory under Art. 37 GDPR, a voluntary advisor under Art. 10 FADP, internal or external.

datenschutz

Data Protection in Real Estate Management

Data protection in property management: data of rental applicants, credit and debt enforcement checks, video surveillance and service providers.

datenschutz

Data Protection in Schools and Education Institutions

Data protection in schools: cantonal law or FADP, consent of minors, Microsoft 365 and Google Workspace, learning analytics, photos and data breaches.

datenschutz

Data Protection in St. Gallen

Data protection in the canton of St. Gallen: cantonal law for public bodies, the FADP for private companies, the financial sector, textiles and universities.

datenschutz

Data Protection for Swiss Associations

Data protection in associations: member data, photos and social media, newsletters and fundraising, minimum standards and a roadmap for the board.

datenschutz

Data Protection in Swiss Medical Practices, DSG, Patient Records, EPR

Data protection in medical practices: professional secrecy under the Swiss Criminal Code, FADP duties towards patients, EPR, insurers and data security.

datenschutz

Data Protection in Swiss Online Shops

Data protection in Swiss online shops: privacy notice at checkout, cookies and retargeting, payment data, service providers, newsletters and the UCA.

datenschutz

Data Protection for Swiss Trustees, FINMA, Banking Secrecy, DSG

Data protection for fiduciaries: FADP, banking secrecy, FINMA outsourcing rules, international tax data flows and anti-money laundering due diligence.

datenschutz

Data Protection Zug, DPO for Crypto Valley Companies

Data protection in Zug's Crypto Valley: FADP and cantonal law, KYC, AML and the travel rule, on-chain data, FINMA supervision and cross-border flows.

datenschutz

Data Protection Zurich, DSG and Cantonal IDG

Data protection in the canton of Zurich: the IDG ZH for public bodies, the FADP for private companies, the cantonal authority's role, cloud and AI.

datenschutz

Data Security vs Data Protection, The Difference Simply Explained

Data protection and data security explained simply: different objects of protection, legal bases and roles, and where they meet in the TOMs.

infosec

DORA × FINMA, Where the Regimes Overlap and Where They Don't

DORA and FINMA compared: where the five DORA pillars and the FINMA circulars overlap, where they differ and how one programme can cover both.

infosec

DORA ICT Third-Party Risk & Register of Information

Building the DORA register of information: legal basis, the data tables of the ESA template, critical functions and common mistakes.

infosec

DORA, Operational Resilience Duties for Swiss Financial Services

DORA for Swiss financial service providers: the five pillars, ICT risk management, incident reporting, TLPT, third-party risk and the link to FINMA.

infosec

DORA Switzerland: When the EU Regulation Applies to Swiss Companies

DORA does not apply directly in Switzerland. When EU subsidiaries, branches and Swiss ICT providers are affected: comparison table, examples and checklist.

kunstliche-intelligenz

EU AI Act, Phases, Obligations, Deadlines for Swiss Companies

Which EU AI Act obligations apply from when: prohibitions, AI literacy, GPAI models and high-risk systems, and what Swiss companies should do now.

kunstliche-intelligenz

EU AI Act, The Guide for Swiss Companies

The EU AI Act for Swiss companies: extraterritorial reach, risk classes, GPAI, obligations of providers and deployers, links to the FADP and GDPR.

datenschutz

External Data Protection Officer Switzerland, Model, Costs, Use Cases

External data protection officer in Switzerland: legal framework in CH and the EU, when the model fits, scope of services, costs and conflicts of interest.

datenschutz

FDPIC (EDÖB), Tasks, Powers and Reporting Channels Explained

The FDPIC explained: position, tasks and investigative powers under the FADP, reporting channels, how an investigation runs and current priorities.

datenschutz

GDPR Compliance, The 8-Point Self-Assessment

GDPR self-check in eight points: lawful basis, records, information, processors, data breaches, DPIA, third countries and governance.

datenschutz

GDPR Explained, The 12 Most Important Obligations

The GDPR in plain terms: twelve core obligations, each with its legal basis, the typical pitfall and the evidence you need.

datenschutz

GDPR Scanners & Audit Tools, What They Measure and What They Miss

What GDPR scanners and cookie tools measure technically, where their limits are and why they cannot replace a legal review.

datenschutz

GDPR Summary, The Key Articles on One Page

The GDPR on one page: its eleven chapters and their most important articles, each summarised in a single sentence.

datenschutz

GDPR Switzerland Checklist – What Applies Beyond the DSG

When the GDPR applies to Swiss companies and what it requires on top of the FADP: EU representative, breach deadlines, privacy notice, checklist.

datenschutz

GDPR Switzerland, What Swiss Companies Need to Know

The GDPR for Swiss companies: when Art. 3(2) applies, EU representative, relationship with the FADP, fines, third-country transfers and first steps.

infosec

Information Security Officer (ISB) as a Service

Information security officer as a service: what the role involves, how it differs from a CISO, legal bases, engagement models and selection criteria.

infosec

Information Security, Standards, Roles and Duties in Switzerland

Information security in Switzerland: ISO 27001 and other standards, Swiss rules from the ISA and FINMA, EU duties and the roles of CISO and security officer.

datenschutz

Instagram Profile under GDPR/DSG, Privacy Notice and Duties

Instagram profiles and data protection: joint controllership with Meta, what your privacy policy must state and data transfers to the US.

datenschutz

Is WhatsApp GDPR-Compliant?, 2026 Update

Is WhatsApp at work compliant with the GDPR and FADP? Contact lists, US transfers, WhatsApp Business, private devices and compliant alternatives.

infosec

ISO 27001:2022, What Has Actually Changed Since 2013

What ISO/IEC 27001:2022 changed compared with 2013: the new Annex A with 93 controls, eleven new controls and the consequences of the transition.

infosec

ISO 27001 Audit, Internal Audit Plan & Template

Planning internal audits under ISO/IEC 27001: audit programme, auditors, sampling, classification of findings, corrective actions and the report.

infosec

ISO 27001 Certification Switzerland, Process, Timeline, Costs

ISO 27001 certification in Switzerland: preparation, choosing a certification body, stage 1 and 2, the surveillance cycle, duration and costs.

infosec

ISO 27001:2022 Checklist, 93 Controls as Self-Assessment

ISO 27001:2022 checklist: the 93 Annex A controls grouped by the four themes, with applicability questions and typical evidence.

infosec

ISO 27001, The Complete Guide for 2026

ISO/IEC 27001 at a glance: the standards family, the 2022 revision, clauses 4 to 10, Annex A, the certification path and links to FADP, GDPR, NIS2, DORA.

infosec

ISO 27001 Certification Costs, Realistic Range for Swiss SMEs

What ISO 27001 certification costs: internal effort, consulting and certification body fees, with realistic ranges by company size.

infosec

ISO 27001 for SMEs, A Simplified Scope Approach

ISO 27001 for SMEs, the lean way: a narrow scope, risk assessment by the owners, minimal documentation and what auditors expect.

infosec

ISO 27001 Recertification After 3 Years

ISO 27001 recertification after three years: how it differs from a surveillance audit, management review, internal audit, SoA and preparation.

infosec

ISO 27001:2022, Building a Correct Statement of Applicability

Building a Statement of Applicability under ISO/IEC 27001:2022: normative requirements, column structure, link to risk treatment, common findings.

infosec

ISO 27701, Layering PIMS on Top of ISO 27001

ISO/IEC 27701 as an extension of an ISO 27001 ISMS: structure of the standard, controls for controllers and processors, joint audits.

datenschutz

Jimdo Privacy Policy Switzerland

Jimdo and Swiss data protection: what the Jimdo generator covers, which gaps remain under the FADP and how to handle third-party services and cookies.

datenschutz

Running Microsoft 365 in a Privacy-Compliant Way in Switzerland

Running Microsoft 365 in line with data protection law: legal framework, EU Data Boundary, encryption, sensitivity labels, audit logs, configuration.

kunstliche-intelligenz

Microsoft Copilot Data Protection, Configuring the M365 Tenant Properly

Introducing Microsoft 365 Copilot in line with data protection law: data location, sensitivity labels, permission clean-up, DLP and mandatory steps.

datenschutz

Microsoft Teams Data Protection, Swiss Configuration Guide

Configuring Microsoft Teams for data protection: data flows, chat retention, recordings, eDiscovery and the right of access, sensitivity labels.

infosec

NCSC / BACS, When Swiss Companies Must Report Cyber Incidents

Reporting duty for cyberattacks under the ISA: which critical infrastructure operators must report, what counts as a reportable attack, deadlines, sanctions.

infosec

NCSC Switzerland, Critical Infrastructure Reporting Duties in 2026

The reporting duty for cyberattacks on critical infrastructure at a glance: current rules, the role of the NCSC, links to NIS2 and DORA, first steps.

datenschutz

DSG Fines, Who Is Personally Liable, and How Much

Fines under the FADP: which breaches are criminal offences, why the fine targets the responsible individual and how this differs from the GDPR.

datenschutz

Swiss DSG vs EU GDPR, The 12 Most Important Differences for SMEs

FADP and GDPR compared: the twelve most important differences in scope, legal bases, obligations, breach notification and sanctions.

infosec

NIS2 Directive, What Swiss Groups with EU Exposure Must Do

NIS2 for Swiss groups with EU links: essential and important entities, minimum measures under Art. 21, reporting duties and the supply chain.

infosec

NIS2, Does My Swiss Company Fall Under It? Self-Assessment

Is my Swiss company covered by NIS2? A five-step self-check: EU establishment, sector, size, supply chain and obligations by status.

infosec

NIS2 Supply-Chain Obligations, What Awaits Swiss Suppliers

NIS2 in the supply chain: which requirements EU customers pass on to Swiss suppliers, contract clauses, audits and reporting channels.

infosec

NIS2 vs ISO 27001, Gap Analysis With Mapping Table

NIS2 and ISO 27001 compared: which Annex A controls cover the minimum measures of Art. 21(2) NIS2 and which gaps remain.

infosec

Penetration Testing Switzerland, Black/Grey/White-Box Compared

Penetration testing in Switzerland: black, grey and white box compared, methodology standards, scoping, retests, reporting and legal aspects.

infosec

Phishing Simulation for SMEs, Setup, KPIs, Reporting

Phishing simulation in SMEs: legal and HR aspects, choice of tool, campaign rhythm, just-in-time training and the right metrics.

datenschutz

Privacy by Design in Swiss Law, 7 Principles

Privacy by design and by default under Art. 7 FADP and Art. 25 GDPR: the seven principles and how to build them into development.

datenschutz

Privacy Policy Generator Comparison: SIDD vs Swissanwalt vs ActiveMind

Privacy policy generators compared: SIDD, Swissanwalt and ActiveMind on FADP and GDPR coverage, languages, records integration and price.

datenschutz

Privacy Policy Template, Mandatory Content Under DSG 2026

A privacy policy field by field: every item required by the FADP with its legal basis, a practical comment and sample wording you can reuse.

infosec

Red Team / Blue Team / Purple Team, Concepts & Use Cases

Red, blue and purple teams explained: goals and approach, how they differ from a pentest, which format fits when, MITRE ATT&CK and contracts.

datenschutz

Schrems II for Swiss Companies, What It Still Means Today

What Schrems II means for Swiss companies today: the Data Privacy Frameworks, transfer impact assessments and remaining risks with US recipients.

infosec

Security Awareness Training Switzerland, Vendors, Setup, KPIs

Security awareness training in Switzerland: providers, programme design, meaningful metrics beyond the click rate and reporting to management.

datenschutz

Shopify Privacy Policy Switzerland, Setup Guide

Shopify and data protection: Shopify's role, the data it processes, what your privacy policy must state, apps, cookies and pixels.

infosec

SOC as a Service Switzerland, Buyer's Guide 2026

SOC as a service in Switzerland: when MDR pays off, scope of services, selection criteria, data residency and professional secrecy, SLAs and prices.

datenschutz

Spark Mail Data Protection, What IT Admins Need to Know

Spark Mail at work: how its proxy architecture works, what access Spark gets, the allocation of roles, professional secrecy and alternatives.

datenschutz

Using Standard Contractual Clauses (SCCs) Correctly

Using standard contractual clauses correctly: choosing the module, Swiss adaptations, transfer impact assessment, annexes and sub-processors.

infosec

Swiss Cyber Security Days 2026, Recap & Conference Guide

Review of the Swiss Cyber Security Days 2026: key topics, talks and market observations, plus tips for attending next year.

datenschutz

Swiss Data Processing Agreement (AVV), Template + Explanation

Data processing agreements under Art. 9 FADP and Art. 28 GDPR: when you need one, the key clauses, sub-processors and audit rights.

datenschutz

Swiss Data Protection Advisor, Duty, Role, Skill Profile

The data protection advisor under Art. 10 FADP: voluntary, but with benefits. Tasks, qualifications, independence and position in the company.

datenschutz

Swiss Data Protection Checklist: 28-Point DSG Self-Assessment

Data protection checklist for Swiss SMEs: 28 points on records, privacy notice, processors, third countries, security and data breaches.

datenschutz

Swiss Privacy Policy Generator: Free Online Builder

Privacy policy generators for Swiss websites: what free builders deliver, when you need more and how a record of processing activities helps.

datenschutz

Swiss Federal Act on Data Protection (DSG), The Complete Guide

The Swiss Federal Act on Data Protection at a glance: scope, principles, data subject rights, obligations, sanctions and the role of the FDPIC.

datenschutz

Swiss Privacy Policy, Everything That Belongs in It in 2026

What a Swiss privacy policy must contain: mandatory content under Art. 19 FADP, recommended additions, multilingual versions and the GDPR interface.

datenschutz

Swiss Privacy Policy – DSG-Compliant Generator 2026

Privacy policy under the FADP: what Art. 19 FADP requires, extra duties for automated individual decisions and when the GDPR also applies.

datenschutz

Swiss Privacy Policy Template (DSG 2026, Free)

Free privacy policy template under the FADP: explained section by section, with notes for public authorities and regulated industries.

infosec

Threat-Led Penetration Testing (TLPT) Under DORA

Threat-led penetration testing under DORA: when TLPT is mandatory, the TIBER-EU process, roles, scope, the supervisory dialogue and the Swiss angle.

infosec

Vulnerability Scan vs Pentest, When Is Each Enough?

Vulnerability scan or penetration test? What each delivers, common tools, a decision matrix and which requirements call for which.

datenschutz

Website Privacy Policy Switzerland: Template + Implementation Guide

Embedding the privacy policy on your website: accessibility, implementation in the CMS, cookie banner, multilingual versions and versioning.

datenschutz

What Does "DSG" Mean?, The Legal Definition in 90 Seconds

What does DSG mean? The Swiss Federal Act on Data Protection explained briefly: what it covers, the key obligations and how it differs from GDPR and BDSG.

datenschutz

What Is Data Protection?, A Quick Introduction

What is data protection? An introduction to personal data, principles, roles, data subject rights, FDPIC supervision and when FADP or GDPR applies.

datenschutz

Wix Privacy Policy Switzerland

Wix and Swiss data protection: Wix's role, data flows, what your privacy policy must state, apps, cookies and consent.

alle

Data Protection Trends 2025: Insights for Swiss Companies

The 2025 data protection trends bundle the regulatory and technical developments most relevant for Swiss companies. This article positions the AI Act, DORA, FINMA expectations and FDPIC practice in concrete terms.

alle

Data Protection Case Law in Mecklenburg-Vorpommern: Structural Lessons for DACH Controllers

Administrative court proceedings between controllers and supervisory authorities in Mecklenburg-Vorpommern concretise the requirements for GDPR implementation. The article situates the structural lessons and transfers them to DACH practice.

alle

Data Protection in Switzerland: the Legal Framework in Detail

The Swiss DSG (Federal Act on Data Protection / FADP) has applied since 1 September 2023. This article analyses the legal framework, the duties of controllers and the role of the FDPIC.

alle

Employee Consent: When It Holds Up, When It Does Not

Consent in the employment relationship means the explicit agreement by employees to the processing of their personal data. Because of the power imbalance, it is rarely the right legal basis in Switzerland.

alle

C5 Equivalence Ordinance: Impact on Data Protection in Switzerland

The German C5 Equivalence Ordinance defines which cloud security attestations are recognised as equivalent within the scope of the C5 catalogue. It has indirect but relevant implications for Swiss cloud consumers and providers.

alle

GDPR in the Mirror of CJEU Case Law: Lines, Trends and Consequences for DACH Controllers

CJEU case law has been concretising the interpretation of the GDPR since 2018 and increasingly shapes the application of the Swiss DSG. The article analyses the key lines and derives concrete duties for controllers in the DACH region.

alle

Data Protection Challenges in the Digital Age: A Swiss Guide

Data protection in the digital age means handling personal data lawfully across connected, automated and cloud-based processes. This guide sets out six concrete challenges for Swiss organisations.

alle

Swiss Data Protection Law in the International Context

The Swiss DSG (FADP) sits within a dense network of international requirements. This article positions adequacy, the DPF, SCCs and BCRs, and the tension between DSG, GDPR and the US CLOUD Act.

alle

Data Security in Switzerland: Best Practices under the DSG and ISO/IEC 27001

Data security under Swiss law requires risk-based technical and organizational measures (TOMs) under Art. 8 DSG. This guide shows how to map those requirements concretely onto ISO/IEC 27001:2022 Annex A.

alle

DPC Ireland IN-19-9-3: Structural Analysis of the Meta Decision and Consequences for DACH Controllers

Inquiry IN-19-9-3 of Ireland's Data Protection Commission targeted Meta Platforms Ireland and concretised the legal bases for contract-based processing. The article analyses the decision and transfers it to DACH practice.

alle

CJEU Preliminary Reference C-383/23 ILVA: Fine Calculation and the Undertaking Concept in GDPR Sanctioning Law

The preliminary reference C-383/23 ILVA concerns the interpretation of Art. 83 GDPR and in particular the relevant turnover concept for fine calculation. The article analyses the procedural questions and derives consequences for DACH compliance.

alle

Data Protection Obligations for Pension Funds in Switzerland

Swiss occupational pension funds (Pensionskassen) process special-category personal data of the second pillar and are subject simultaneously to BVG supervision and DSG duties. This guide shows how both regimes can be combined in practice.

alle

Data Security in Browser Extensions: An Examination of Microsoft Edge Add-ons

Browser extensions are small programs with far-reaching access to the entire web traffic. This analysis sets out the permission model, typical attack patterns and how organisations can protect themselves, using Microsoft Edge add-ons as the worked example.

alle

AI and Data Protection in Switzerland: Duties, Contracts, Security

AI data protection in Switzerland refers to the duty, when using ChatGPT, Copilot or in-house models, to comply with the DSG and to observe EU rules wherever they apply extraterritorially.

alle

FINMA Supervisory Notice 03/2024: Expectations on Cyber Risk Management

FINMA supervisory notice 03/2024 specifies the expectations on cyber risk management for supervised institutions. It summarises lessons from notifications under Art. 29 FINMASA and sharpens supervisory practice and audit focus.

alle

C5 Attestation: Relevance and Challenges in Switzerland

The C5 attestation is a cloud assurance report defined by BSI and issued under ISAE 3000. It assesses whether a cloud provider meets the C5 catalogue requirements and is gaining relevance for Swiss cloud consumers.

alle

AEPD Proceeding EXP202213023: What Swiss Companies Can Learn from the Spanish Fine

In proceeding EXP202213023 the AEPD (Agencia Española de Protección de Datos) sanctioned the deficient implementation of the right to erasure. The article situates the fine and transfers the lessons to GDPR and Swiss DSG compliance for Swiss controllers.

alle

Operational Risks and Resilience: FINMA Circular 2023/01 in Practice

FINMA Circular 2023/01 'Operational Risks and Resilience - Banks' has been in force since 1 January 2024. It consolidates the requirements on operational risk management, ICT risks and operational resilience.

kunstliche-intelligenz

Data Protection in the Era of Artificial Intelligence: Opportunities, Risks, and Regulatory Requirements in Switzerland

This article explores the intersection of data protection and artificial intelligence by examining both the legal and technical challenges, as well as the opportunities that arise from their interaction.

datenschutz

Analyzing a Spanish Data Protection Case: The Importance of Consent

In a recent case handled by the Spanish Data Protection Authority (AEPD), the role of consent as a fundamental basis for lawful personal data processing was highlighted. The case emphasizes the significance of transparent communication and clearly defined processes in data management to ensure compliance with data protection laws.

kunstliche-intelligenz

Regulation of Artificial Intelligence in Switzerland: A Deep Insight

With the rapid growth of artificial intelligence (AI), regulatory frameworks face complex challenges. Switzerland is actively working on establishing a framework to ensure fairness, transparency, and accountability.

datenschutz

Data Protection Challenges in Switzerland: Learning from Case C-413/23

This article explores the implications of Case C-413/23, EDPS v. SRB, for Switzerland, focusing in particular on the associated data protection challenges and strategies for addressing them.

datenschutz

Guidelines for the Use of Artificial Intelligence in Financial Institutions in Switzerland

The introduction of artificial intelligence (AI) in financial institutions offers numerous benefits but also presents regulatory challenges. The Federal Financial Market Supervisory Authority (FINMA) has developed guidelines to ensure the safe use of AI.

alle

EDPB Issues Ban on Meta's Processing of Personal Data

The EDPB has imposed a landmark ban on Meta involving the use of personal data without express consent. This article explains why this ban was enacted, which legal framework is affected, and what effects it could have on companies in Switzerland.

datenschutz

Obligations of Contract Processors under the GDPR

In the digital economy, contract processors play a crucial role in data protection. These experts help those responsible for data processing meet numerous obligations under the GDPR. In this article, we explore the roles and responsibilities of contract processors in Switzerland.

alle

Guidance on How to Deal with Data Breaches: Recommendations from the FDOEB

Data breaches pose a significant threat to businesses. This article outlines the recommendations from the Federal Data Protection and Information Commissioner (FDPIC) on how to effectively handle such incidents.

kunstliche-intelligenz

In-Depth Analysis of the EU Commission’s Guidelines on AI System Concepts

The European Commission has published clear guidelines on the concept of an AI system. This article highlights their significance, the impact on Swiss legislation and future measures to ensure data protection.

alle

Automating Compliance with AI in Switzerland: A Guide

Compliance in an increasingly digital world can be complex. In Switzerland, the use of artificial intelligence (AI) presents a promising solution for automating and optimizing compliance processes while ensuring adherence to data protection regulations.

datenschutz

The ECJ’s Data Protection Fine Concept: A More Detailed Analysis

This article examines the implications of the European Court of Justice (ECJ) ruling on the concept of data protection fines under the GDPR and explores the potential consequences for companies in Switzerland. Particular attention is given to how this ruling may influence enforcement practices, legal certainty, and risk management for cross-border data processing activities.

alle

FDPIC Guidelines on Cookies and Similar Technologies: A Comprehensive Guide

The use of cookies and similar technologies is widespread, but many companies face challenges in complying with privacy regulations. This overview of the FDPIC guidelines provides clear instructions and recommendations for implementing these technologies in accordance with data protection laws.

alle

Fingerprint Tracking: Circumventing Data Protection Guidelines in the EU?

Fingerprint tracking allows companies to identify users without using traditional cookies. This potentially constitutes a circumvention of European data protection guidelines and could also raise data protection concerns in Switzerland.

kunstliche-intelligenz

Legal Aspects of Using AI Providers in Switzerland

The use of AI technologies presents both opportunities and risks for Swiss companies. In this article, we examine the key legal aspects and provide guidance on ensuring compliance with data protection regulations.

infosec

ISO 27001 Implementation: Do it yourself or use a Packaged Solution?

Implementing ISO 27001 presents companies with a decision: Develop it in-house or use a packaged solution? This analysis highlights the benefits of both approaches, particularly in the context of the Swiss data protection landscape.

datenschutz

Navigating ISO 27001 Certification: Tips from the Experts

Get expert advice on how to successfully achieve ISO 27001 certification.

datenschutz

How to Master the ISO 27001 Audit Process in 30 Days

Master the ISO 27001 audit process in 30 days with our comprehensive guide.

datenschutz

Article 27 GDPR Compliance Guide

Discover the basics of compliance with Article 27 of the GDPR. Learn more about EU representatives, exemptions, and key obligations.

kunstliche-intelligenz

AI in HR

AI in HR

infosec

The Future of Data Protection in the Light of the Digital Operational Resilience Act (DORA)

The Future of Data Protection in the Light of the Digital Operational Resilience Act (DORA) and Its Impact on the Financial Sector

datenschutz

The Data Protection Aspects of Corporate Acquisition/M&A

The Data Protection Aspects of Corporate Acquisition/M&A, Be It Share Deals (Share Acquisition) or Asset Deals

infosec

Act to Speed Up the Digitization of Healthcare

On December 14, 2023, the Bundestag adopted a bill to speed up digitization.

datenschutz

Data Protection Regulations in Switzerland

FADP Audit in Switzerland: What Changes Are Relevant for Your Company or SME

datenschutz

Current Activity Reports from Data Protection Authorities

Activity Reports from European Data Protection Authorities

infosec

Experiences from the Use of ISO 27001 in SMEs

ISO 27001 Certification is Becoming Increasingly Important for Small and Medium-Sized Enterprises (SMEs)

datenschutz

How to become a Data Protection Officer in 5 steps

Learn how to become a Data Protection Officer with those 5 steps.

datenschutz

What is Personal Data?

Personal Data and its Regulation in Switzerland

datenschutz

External Data Protection Officer

With external data protection officers, you gain security.

datenschutz

Risk-Based Approach for SMEs

Data Protection Law requires a risk-based Approach in defining TOM

datenschutz

Implementation and Compliance with Data Protection Regulations

Data Protection, Consultants, and Management Systems as Key Elements of Compliance

datenschutz

Data Protection as a Differentiating Criterion

Reliable Data Protection as a Key Differentiator for Your Start-Up or ICT Company

datenschutz

GDPR/Data Protection Project: Tips to get Started

How to Start, Implement, and Successfully Complete a Data Protection Project

datenschutz

The EU Representative

The Future of Data Protection in the Light of the Role of the EU Representative for Companies Outside the European Union

datenschutz

Report to the Data Protection Authority

In accordance with Article 4(12) GDPR, a personal data breach refers to a security violation.

datenschutz

Schrems II: Privacy Shield Invalid

With the ruling of July 16, 2020, the Privacy Shield was declared invalid with immediate effect.

datenschutz

Contact Forms under the GDPR

Contact forms do not require consent under GDPR.