Data Breach, What Now?

Part 14 of our series on data protection law in Switzerland

In this part of our series, we analyse if and under which circumstances personal data breaches must be notified to the competent authorities in Switzerland.

Notification obligations under the Swiss Federal Act on Data Protection (FADP)

Under the revised Swiss Federal Act on Data Protection (FADP), time is of the essence when a data security breach occurs. If any data security breach may likely lead to a high risk to the personality or fundamental rights of those individuals affected, controllers are legally required—under Art. 24(1) FADP—to notify the Federal Data Protection and Information Commissioner (FDPIC) as quickly as possible.