Text carried over, to be reviewed by Sanjco. Not a substitute for legal advice.
Since 1 September 2023, the revised Federal Act on Data Protection has imposed new requirements on Swiss companies. Many organisations found out about them through an audit or a request from a client.
This article is not legal advice. It is a practical starting point, from the information systems side.
The first question is not a legal one
It is about documents: where is your personal data, and who can access it?
As long as the answer is “all over the place”, no policy will hold. Data about your employees, your clients and your job applicants sits in the ERP, in the payroll files, in email inboxes, in a shared spreadsheet and in a forgotten folder on the server.
Where we start
Our engagements on this subject generally follow four stages.
- An audit and recommendations. We establish what you hold, where, and for how long.
- An analysis of the sensitive data held in the ERP and in the other management systems.
- Security tests on access, followed by recommendations ranked by priority.
- Setting up a document management solution when it solves part of the problem, by centralising what was scattered.
What document management brings
A document vault is not a legal answer, but it makes three things the law requires easier.
- Knowing who has access to what. Access rights follow the document and its content, not the location of the file.
- Knowing who has viewed what. Every opening and every change is logged.
- Knowing how to delete. When a retention period is attached to the document, purging stops being a manual and uncertain operation.
What we do not do
We do not write your privacy policy and we do not take the place of your legal adviser. We document what your systems do, so that the person drafting it works from facts.
Not sure where your organisation stands on this? Write to us to arrange an audit of your data, over half a day, at your offices.