The Revised Federal Data Protection Act – Sanctions Increase As Of 1 September 2023

Key takeaways

• Criminal fines under the revised Federal Data Protection Act of up to CHF 250'000 are to be imposed primarily on an individual and not on a legal entity.
• The catalog of criminal actions that may lead to fines is expanded but is still limited.
• The requirements that the individual acted with intent and that the data subject concerned lodges a complaint continue to be a serious threshold for convictions.
• Neither indemnification agreements nor D&O insurances, but actual internal compliance processes and reporting are necessary to mitigate the exposure of individual employees.

Introduction

As of 1 September 2023, the revised Federal Act on Data Protection (revFADP) will come into force. Under the revFADP, undertakings and their employees will not only be confronted with new obligations regarding the processing of personal data (see here: https://pestalozzilaw.com/en/insights/news/legal-insights/revised-federal-act-data-protection/) but