Switzerland's revised DSG has been enforceable since September 2023. Violations carry personal fines of up to CHF 250,000, not against the company, but against your employees. We take on the mandate before it becomes a liability.
Working for regulated industries and SMEs
⚠️ Act now
The DSG is live. Companies without a data protection structure today are exposed, not eventually, but now.
Brief definition
Data-protection advisors (DPOs) are appointed by a company or organisation to monitor compliance with the revised FADP, to advise the company and to oversee implementation. The person must have the necessary expertise and independence and may not be disadvantaged or dismissed in the exercise of this role.
In Switzerland, appointment is generally voluntary (Art. 10 revised FADP). It is nonetheless advisable if you wish to complete high-risk data protection impact assessments (DPIAs) without consulting the FDPIC, demonstrate your accountability and protect your employees from fines of up to CHF 250'000.
These four scenarios are the most common triggers for a DPO mandate at Swiss SMEs and corporate groups.
You regularly process personal data on a large scale or sensitive data (health, financial, biometric).
You operate in a regulated sector (FINMA, MedTech, EPRA obligations, pharma, aviation) and must document compliance.
You sell to EU customers, and must additionally comply with the GDPR.
You want to complete DPIAs without consulting the FDPIC, thereby shortening time-to-market in data-intensive projects.
Unsure? Our price calculator clarifies in 60 seconds whether a DPO mandate makes sense for you, and gives you the matching rate straight away.
A comprehensive DPO mandate under Art. 10 revised FADP, operational, advisory and supervisory.
The effort depends heavily on company size, sector and IT complexity. Effort drivers are:
~10 h
typical weekly effort for 250 employees
24 h
guaranteed initial response to client enquiries
CHF 250k
maximum fine for breaches of the revised FADP (Swiss DSG)
Three clear pricing tiers, from an SME entry option to a tailored group mandate. All prices include access to the SIDD platform.
Standard · SME
from CHF 500 / month
Fixed quarterly mandate: half a day per quarter plus availability for standard enquiries. Ideal for SMEs with 25–150 employees.
Premium
annual quota custom
Flexible annual quota from 30 h. Ideal for SMEs with 150–500 employees or projects requiring a DPIA.
Group · Custom
On request
Mandate within a regulated or multinational group structure, typically with a dual GDPR/revised FADP mandate and a FINMA or EPDG dimension.
From contract to ongoing support in six steps. Typical onboarding period: 14 days.
Digital service contract with a clearly defined scope of services as DPO.
Workshop to get to know each other, align expectations and agree on next steps.
Inventory of data-protection-relevant processes, systems and documents.
Action plan: privacy notices, ROPA, DPIAs, data processing agreements, internal policies.
Support with practical implementation, advice, training, review, communication with authorities.
A fixed point of contact, ongoing monitoring and updates to reflect new regulatory conditions.
We are neither a pure law firm nor a pure IT shop, we are both. That makes us resilient for regulated mandates.
You fully outsource the recruiting, training and backup of an internal DPO function to us.
Over 10 years of international data-protection practice, three lawyers with a doctorate and an ISO 27001 lead auditor.
Actively avoid fines, reputational damage and personal liability for executive management and the board of directors.
An external perspective free from internal company politics, an advantage in conflicts with other departments.
A clear data-protection practice increases the trust of customers, employees and business partners.
All enquiries are subject to professional secrecy under Art. 321 SCC, just as with a law firm.
We handle DPO mandates in aviation, healthcare, HR tech and consulting, from SMEs to large corporations.
Aviation · GDPR + FADP
Dedicated DPO mandate, Priverion Platform, connected-aircraft data and supplier DPAs, multi-jurisdiction compliance achieved.
Read the case studyHealthTech · revised FADP + EPRA
Data-flow analysis, new DPAs with thousands of customers, penetration test plus vulnerability scan, full compliance with the revised FADP demonstrated.
Read the case studySwiss SMEs are subject to the same revised FADP as large corporations, usually without an in-house data protection function. SIDD handles data protection for SMEs as a lean fixed-fee mandate: revFADP baseline assessment, record of processing activities, privacy policy and staff training.
Microsoft 365, AWS and Azure can be operated in an FADP-compliant way when data processing, data residency and transfer mechanisms are properly governed. We review your cloud configuration, put the required data processing agreements (DPAs) in place and document the safeguards for data transfers to the USA and other third countries.
Medical practices, clinics and MedTech companies process sensitive health data and are additionally subject to the EPRA and medical confidentiality. SIDD sets up data protection for medical practices and healthcare in an FADP-compliant way, from IT in the practice to patient records.
The revised Swiss Data Protection Act (revFADP, also known as nFADP) has applied since 1 September 2023. We bring your organisation into FADP compliance: record of processing activities, data protection impact assessments, breach notification procedures and the duties towards the FDPIC.
As soon as you offer goods or services to people in the EU or monitor their behaviour, the GDPR also applies. SIDD brings Swiss companies into GDPR compliance and, where needed, acts as your EU Representative under Art. 27 GDPR.
We know the sector rules that go beyond the revised DSG.
We work with the Priverion Platform, the Swiss data-protection software of our sister company. Record of processing, DPIA, risk register and audit modules in one place, hosted in Switzerland.
Our mandate also covers the legal side: data processing agreements (DPAs), privacy notices, data-subject requests, contracts with service providers and correspondence with the FDPIC. Led by lawyers admitted to the bar, not only IT specialists.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For your external DPO mandate, concretely: LexCommand backs every revDSG and GDPR statement in the processing register, the DPIA and the data processing agreements with an exact primary source, keeps the Swiss and EU duties cleanly separate, and surfaces overlapping obligations side by side.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
Our entry-level Standard package starts at CHF 500 per month for SMEs with manageable data-protection volumes. Premium mandates with a flexible annual quota from 30 hours typically range between CHF 1'200 and CHF 3'500 per month. Corporate mandates are priced individually.
You can determine the right rate for your situation in 60 seconds using our price calculator.
Standard and Premium mandates run for 12 months with annual renewal. Corporate contracts typically run for several years with quarterly reviews. We impose no hidden notice periods, ordinary termination is always possible at the end of the contract term.
We support the transition. You receive all mandate documents, the ROPA and a knowledge-transfer workshop for your internal DPO function. We optionally remain available as a sparring partner with an hourly quota.
Yes. Dr. Staiger is an Attorney at Law (New York) and a Solicitor (UK). We take on the dual mandate as Data Protection Officer (revised FADP) and Data Protection Officer (Art. 37 GDPR), and can additionally act as your EU representative under Art. 27 GDPR or as your UK representative.
Responsibility for the processing remains with the company, even an external DPO does not change that (Art. 5 revised FADP). We minimise the risk through ongoing monitoring, documented recommendations on technical and organisational measures, and a clear incident playbook. Executive management and the board of directors are included in our reporting.
Initial response to client enquiries within 24 hours, typically within 4 hours on business days. In the event of data breaches and contact with authorities, you can reach us via a 24/7 emergency line under the Premium and Corporate plans.
Yes. Enquiries to SIDD are subject to Swiss professional secrecy under Art. 321 SCC. Your client communications and all insights obtained are therefore protected against access by the state within a framework similar to that of a law firm.
30 minutes. We tell you exactly where you stand, no jargon, no sales pitch.