The data protection act sets out a number of requirements for companies that process personal data. These include the obligation to publish a privacy policy, to respect the data protection rights of the individuals concerned and to ensure data security. In the following article you will learn who the new data protection act applies to, what personal data is and what a privacy policy is.
For whom does the data protection act apply?
The new data protection act and its ordinance apply when it comes to the processing of personal data by natural and legal persons including federal authorities. Private individuals who process personal data only for their own use are in principle exempt from compliance with data protection requirements. This exception "for personal use" refers only to the processing of data in the closest personal and family environment (i.e. data of close family members and friends). Public websites do not normally fall under the category “for personal use” - even if they are run by a private individual. Therefore, private website operators, just like commercial ones, are regularly affected by the new provisions of the data protection act and the data protection ordinance.
What does “processing of personal data” mean?
According to the new data protection act, personal data means all information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, date of birth or an IP address. Processing comprises any handling of personal data, irrespective of the means and procedures applied, in particular the retention, disclosure, procurement, collection, deletion, storage, modification, destruction and use of personal data. Data protection law does not protect the data itself, but the people behind it, whose data is processed.
What is a privacy policy?
A privacy policy is a document. It describes what information the company collects, how this data is processed and for what purposes it is used. It also explains whether this data is forwarded to other people, companies and/or third parties. Additionally, it outlines the steps the company takes to protect the privacy of its clients and who within the company is responsible for data processing.
Why is a privacy policy needed?
The privacy policy is necessary to ensure transparency. It explains to visitors of a website what personal data is collected and why it is used. They also show whether and what data is passed on to other people. Put simply, visitors must receive sufficient and easy-to-understand information about what personal data is collected and what happens to it, so that they can decide for themselves whether and how they want to disclose their data. Furthermore, users must get all necessary information to enforce their rights. Therefore, the declaration should be written with care, accuracy and in a language that visitors can easily understand. If the website is available in several languages, the privacy policy should also be in those languages.
When do I need a privacy policy?
A privacy policy is necessary wherever personal data is collected and/or processed. This includes in particular:
Websites
Newsletters
Contracts with private individuals
Marketing campaigns
Conclusion
The revised data protection act strengthens the rights of affected persons and places higher demands on companies that process personal data. In particular, small and medium-sized enterprises should review their internal processes and documentation for the new specifications. Violations can in future also have criminal consequences for responsible persons. If you act early, you not only reduce legal risks, but also strengthen the trust of your customers.
The creation of a privacy policy can become a time-consuming and complex challenge. For this reason, we have developed a solution that makes the process as easy as possible for you.
