On 31 August 2022, the Federal Council officially
adopted the revised Data Protection Ordinance (revDPO") as
well as the Ordinance on Data Protection Certifications and
confirmed that the Ordinances together with the revised Data
Protection Act (revDPA") will enter into force on 1 September
2023. As a result, companies and other persons processing personal
data have one year to implement the new requirements in their
organisations. There will be no further grace period, and companies
should get ready now.
AT A GLANCE
With the newly adopted revDPO, the Federal Council exercised its
competence to clarify and specify certain obligations of the
revDPA. In particular, the revDPO provides implementing provisions
on data security, information and documentation obligations, the
rights to access and data portability, the outsourcing of data
processing to third parties, cross-border data transfers, the data
protection advisor (i.e., data protection officer), data
