The new Swiss Data Protection Act and what employers need to consider

The revised data protection legislation in Switzerland brings with it a number of changes that will affect companies in general. In particular with regard to their function as employers, companies must comply with new and extended documentation obligations.

The most important changes at a glance

The key changes to the new data protection law include, in particular, the following:

• The data of legal entities are no longer covered by the revDSG, but only those of natural persons.
• The definition of particularly sensitive data has been expanded to include genetic and biometric data.
• The principles of ‘privacy by design’ and ‘privacy by default’ are being introduced, which means that software, hardware and services must be designed in such a way that data protection is guaranteed at all times.
• Data protection impact assessments must be carried out where there is an increased risk to personal privacy or fundamental rights.
• The obligation to inform data subjects will be substantially extended (proactive information must be provided each time data is obtained) and new documentation obligations will be introduced (e.g. record of processing activities).
• The range of fines for wilful violation of the revDSG is increased from CHF 10,000 to CHF 250,000 and is directed against the person in the company who personally committed the violation. Prosecution will take place upon request.

For employers, there are two main changes in relation to their employees, which are highlighted below.

The introduction of the record for processing activities

The introduction of a record of processing activities is mandatory for companies. It is intended to ensure the traceability and verification of all data processing activities within the company. Among other things, the record of processing activitiesmust contain information on the purpose of processing, categories of data subjects and categories of personal data processed, the retention period and measures to ensure data security.

A large amount of personal data is typically processed in the employment relationship - from recruitment, personnel administration and payroll accounting to performance and career reviews and development. From 1st September 2023, this data processing must be comprehensively documented in the record of processing activities. It should be noted that companies with fewer than 250 employees are exempt from this obligation, provided that the company's activities do not involve any risky data processing. There are no penalties for failing to implement this requirement. However, implementation is still highly recommended, as it raises awareness of how personal data is handled within the company.

Extended information obligation and data protection declarations

As a consequence of the extended information obligation, companies are strongly recommended to review existing data protection declarations or to introduce data protection declarations where they do not yet exist. The duty to provide information applies in principle to every company, regardless of its size. With regard to employees, it is recommended that the privacy policy be included in the employment contract or provided as a separate document.

It should be noted that the duty to provide information also applies to (rejected) job applicants, as personal data is inevitably processed in relation to them. The data protection declaration can be referred to in the reply letter by means of a link, for example, or a data protection declaration can be added as a separate document. The duty to inform also applies to former employees if personal data continues to be stored.