EU Data Protection - Serious Impact On Swiss Companies

Background

On April 14, 2016 the EU Parliament adopted the new EU Data Protection Regulation (PDF, 0.9 Mb) ("GDPR") which will become binding in all member states in 2018. The extraterritorial character of this new regulation will also impact Swiss companies. In Switzerland a working group on data protection will submit a report to the Federal Council by the end of August 2016 which may lead to an update of Swiss local data protection regulation as well.

What is new?

The GDPR provides several new obligations that companies have to fulfil. Some of the more relevant rules are listed below:

• Obligation to notify supervisory authorities in case of a personal data breach within 72 hours (Art. 33 GDPR) and obligation to notify data subject in case of high risk. Both will significantly increase the risk of potential reputational damages.