nLPD Guide: how to achieve compliance?

What is the nLPD?

The nLPD modernises Swiss data protection law to align it with European standards and preserve the adequacy recognition with the EU — essential to allow data to flow freely between Switzerland and the Union.

It introduces concepts now familiar to GDPR practitioners: privacy by design and by default, records of processing activities, impact assessments, enhanced information at the point of collection, and breach notification to the FDPIC.

It nonetheless retains certain structural specificities: a scope limited to natural persons, a sanctions regime oriented towards individual criminal liability, and certain obligations formulated differently from their European equivalents.

nLPD vs GDPR: the differences you need to know

This is the crucial point for companies already compliant with GDPR. Here are the gaps that require specific adaptation.

The most consequential difference is the individual criminal liability regime: in Switzerland, it is often the executive or the person in charge who is personally targeted.

Who is affected?

The nLPD applies to processing carried out by private individuals and federal bodies. It concerns all organisations that process personal data of natural persons, regardless of their size.

• Swiss companies of any size processing personal data of natural persons.
• Processors acting on behalf of a data controller.
• Groups operating on both sides of the border, who must reconcile the nLPD and GDPR.
• Sectors handling sensitive data as defined under Swiss law (health, HR, finance).

What are the concrete obligations?

The obligations largely overlap with those of GDPR, with Swiss nuances. Here are the key measures to implement.

• Maintain a record of processing activities (with allowances for SMEs under certain conditions).
• Inform individuals at the time of collection, in a transparent and understandable manner.
• Respect privacy by design and privacy by default.
• Conduct a data protection impact assessment for high-risk processing activities.
• Notify the FDPIC of breaches entailing a high risk, as soon as possible.
• Govern subcontracting through contracts and proportionate security measures.
• Specifically protect sensitive data as defined under the nLPD.

What penalties apply in the event of non-compliance?

Switzerland's distinctive approach is significant: criminal sanctions target primarily the responsible natural persons, not just the organisation. This considerably raises the stakes around internal governance and the clear assignment of responsibilities.

The regime differs markedly from GDPR: here, fines target the responsible individual, which requires clearly designating and documenting who is accountable for what.

How to achieve compliance: the 7-step roadmap

Step 1 — Map your processing activities

Identify all personal data processing activities involving individuals: customers, employees, prospects, suppliers. For each one, record the purpose, data categories, recipients and retention periods.

Pay particular attention to sensitive data as defined under Swiss law, the processing of which requires heightened vigilance.

• Identify sensitive data as defined by the nLPD.
• Record purposes, recipients and retention periods.
• Distinguish your roles as controller and processor.

Step 2 — Appoint an internal data owner

Designate an internal compliance officer responsible for driving the process and acting as the point of contact with the FDPIC. Given the individual criminal liability regime, clearly establish who bears responsibility.

This clear allocation of responsibilities is all the more important since sanctions target the responsible natural person.

• Appoint a clearly identified compliance officer.
• Clarify who bears responsibility for each processing activity.
• Document the allocation of responsibilities.

Step 3 — Update information notices and disclosures

Adapt your privacy policies and information notices to meet the nLPD's transparency requirements at the point of data collection. Information must be clear, complete and understandable.

If you are starting from a GDPR basis, verify that the wording and scope align with Swiss requirements.

• Provide clear information at every point of collection.
• Cover purposes, recipients and data subjects' rights.
• Adapt your GDPR notices to the Swiss context.

Step 4 — Maintain the register

Establish and maintain a record of processing activities. SMEs may benefit from exemptions under certain conditions, but as soon as high-risk or sensitive processing activities exist, maintaining a full register becomes mandatory.

A living register is also your best protection in the event of an FDPIC investigation.

• Verify eligibility for SME exemptions.
• Link each processing activity to its purpose and retention periods.
• Keep the register continuously up to date.

Step 5 — Secure data and assess risks

Apply privacy by design and by default, secure data through proportionate measures, and conduct a data protection impact assessment for high-risk processing activities.

Security is a particularly sensitive area, as its failure may trigger the criminal liability of the controller.

• Embed data protection from the design stage.
• Conduct an impact assessment for high-risk processing activities.
• Deploy proportionate security measures.

Step 6 — Govern data processing agreements

Formalise compliant data processing agreements with your service providers, specifying purposes, security, confidentiality and the fate of data at the end of the contract.

Identify your processors and assess their guarantees: their failure may engage your liability.

• Sign compliant data processing agreements.
• Identify and assess your processors.
• Govern any further sub-processing.

Step 7 — Prepare breach management procedures

Establish a detection and notification procedure for reporting to the FDPIC in the event of a breach entailing a high risk for the individuals concerned, without undue delay.

As with GDPR, this procedure cannot be improvised: prepare and test it in advance.

• Define the detection and qualification workflow.
• Prepare notification to the FDPIC.
• Document each incident and its handling.

Common mistakes to avoid

• Assuming GDPR compliance is automatically sufficient: Swiss specificities must be addressed point by point.
• Underestimating the individual criminal liability risk specific to the Swiss regime.
• Overlooking the specific protection of sensitive data as defined under the nLPD.
• Failing to clarify who bears responsibility, given that sanctions target natural persons.
• Neglecting preparation for breach notification to the FDPIC.
• Reusing GDPR wording without adapting it to Swiss terminology and scope.