What is the nFADP?

Definition

The nFADP (new Federal Act on Data Protection) is the complete revision of the Swiss Federal Act on Data Protection (FADP) of 25 September 2020, which entered into force on 1 September 2023. It replaces the old FADP of 1992 and fundamentally modernises the Swiss legal framework to bring it in line with technological developments and European standards (GDPR).

It is accompanied by the Ordinance on Data Protection (ODP) and by the directives of the FDPIC (Federal Data Protection and Information Commissioner).

Key obligations

Register of processing activities

Companies whose data processing presents a high risk to the rights of the persons concerned must maintain a register of processing activities documenting: the purpose of the processing, the categories of data, the recipients, the retention periods and the security measures.

Data Protection Impact Assessment (DPIA)

Before launching any data processing likely to present a high risk (profiling, large-scale processing of sensitive data, systematic surveillance), a data protection impact assessment (DPIA) is mandatory.

Breach notification

In the event of a data security breach (leak, hacking, loss), the company must notify the FDPIC without delay if the breach is likely to create a high risk for the persons concerned. Persons directly affected must also be informed.

Privacy by Design and by Default

The nFADP codifies the principles of data protection by design and by default: systems and processes must incorporate data protection from the outset, and the default settings must be the most privacy-protective.

Rights of data subjects

The nFADP strengthens the rights of natural persons whose data is processed:

• Right of access — to obtain a copy of the data held.
• Right to rectification — to have inaccurate data corrected.
• Right to data portability — to receive their data in a structured format.
• Right to object — to object to processing, particularly to high-risk profiling.

Swiss context

The nFADP applies to companies established in Switzerland and, by extension, to foreign companies whose processing has effects in Switzerland (an extraterritoriality principle comparable to the GDPR). The FDPIC is the independent supervisory authority responsible for its enforcement. It may conduct investigations and issue binding recommendations.

Unlike the GDPR, whose fines target companies (up to 4% of global turnover), the nFADP provides for criminal penalties against natural persons responsible for infringements — fines up to CHF 250,000 per offence.

How Neoffice addresses it

Neoffice hosts its clients' data on servers located in Switzerland, meeting data localisation requirements. The ERP integrates traceability mechanisms (access logs, change history), role-based access control, and management of data subjects' rights (access, rectification, deletion). These features facilitate nFADP compliance for SME clients.