The GDPR (EU General Data Protection Regulation) affects not only companies in the EU, but also Swiss companies that:
Offer goods or services in the EU
Monitor the behaviour of individuals in the EU
In this article you will find practical tips for the legally compliant design of your privacy concept. We will show you how to efficiently implement the legal requirements while at the same time protecting your business interests. An important step here is the creation of a legally compliant privacy policy that contains all the necessary information and complies with the legal requirements.
Fundamentals of data protection law
The General Data Protection Regulation (GDPR) defines clear rights for individuals whose data is processed by companies. For Swiss companies, the revised Federal Act on Data Protection (FADP), in force since 1 September 2023, applies first and foremost. It provides for comparable rights, such as the right of access (Art. 25 FADP) and the right to data portability (Art. 28 FADP). These rights strengthen the position of the data subjects and create binding obligations for companies.
Rights of the data subjects
The GDPR grants individuals the following central rights in the handling of their personal data:
Right to information: Transparent information about the processing of data
Right of access: Detailed access to stored personal data
Right to rectification: Correction of incorrect or incomplete data
Right to erasure: Complete removal of data ("right to be forgotten")
Right to data portability: Transfer of data to other service providers
Right to object: Objection to the processing of data
For companies, this means implementing technical and organizational measures to ensure these rights. The scope of the GDPR extends, among other things, to:
Structured data sets in IT systems
Paper-based files with personal information
Digital communication and documentation
Customer databases and CRM systems
The practical implementation of data protection requires various fundamental measures in companies. First, documented processes for processing data subject requests must be established, ensuring a structured and traceable process. Furthermore, it is essential to define clear responsibilities and binding response times to ensure efficient processing. Another important aspect is the implementation of secure identity verification systems that prevent unauthorized access to personal data. Finally, traceable deletion concepts must be developed that guarantee legally compliant data destruction.
The legally compliant handling of these rights protects companies from legal consequences and strengthens customer trust in data processing.
Penalties for breaches of the GDPR
Non-compliance with the GDPR can have serious financial consequences for companies:
High fines
Claims for damages of data subjects in the event of data protection violations
Reputation damage through public announcement of violations
Compulsory suspension of data processing by supervisory authorities
The Swiss data protection authorities can additionally:
Open investigations and order administrative measures, such as the adjustment, suspension or termination of processing (Art. 49 and 51 FADP)
File a criminal complaint against responsible persons; fines of up to CHF 250'000 are decided by the cantonal criminal authorities (Art. 60–65 FADP)
Obligate companies to adapt their data processing processes
These strict sanctions underline the importance of a legally compliant implementation of data protection measures in everyday business.
Creating a privacy policy for your company
A legally compliant privacy policy is elementary for the legally compliant processing of personal data in your company. This statement serves to inform your users transparently about all relevant aspects of data collection and processing. In doing so, the type of data collected is detailed and the specific purpose of its processing is set out. The duration of data storage as well as the legal bases on which the processing is based are also clearly communicated. Another important component is the information about a possible transfer of data to third parties. This comprehensive transparency creates trust among users and at the same time ensures compliance with legal requirements.
Structural elements of a professional privacy policy
A privacy policy usually contains the following, essential components:
Responsible body - Name and contact details of the company
Data collection - Detailed listing of all collected data categories
Processing purposes - Precise description of the purposes of use
Storage duration - Period of data storage
Data subject rights - Information about rights of access and objection
Implementing effective data protection measures in your company
The implementation of effective data protection measures requires systematic processes and technical solutions. A structured approach guarantees the legally compliant processing of personal data.
Automation and compliance with software solutions
Modern software solutions offer integrated data protection management systems:
Document management systems with automatic encryption
Access controls with two-factor authentication
Automatic deletion routines after expiration of the retention periods
Logging systems to track data access
The integration of specialized software optimizes data protection processes in a variety of ways. The automatic recognition of sensitive data enables a reliable identification of information worthy of protection in the corporate context. Rule-based processing in accordance with defined data protection guidelines ensures that all processes meet current requirements. The central management of consent declarations significantly simplifies the organization and documentation of user rights. The automated updating of data protection documentation is particularly valuable, ensuring continuous compliance and significantly reducing administrative effort.
Employee training as the key to successful data protection
Regular employee training forms the foundation of effective data protection in the company. A structured training program includes:
Basic data protection principles: Awareness-raising for the secure handling of personal data
Practical exercises: Simulation of situations relevant to data protection from everyday work
Documentation guidelines: Correct logging of data processing processes
Incident Response: Instructions for action in the event of data protection violations
The integration of e-learning platforms enables flexible, individualized training units. Employees learn how to use encryption technologies, secure password practices, and the correct handling of customer data. A special focus is on the recognition of phishing attempts and social engineering attacks through practical examples.
Conclusion: successfully implementing data protection law in your company
Consistent compliance with the data protection law forms the foundation for sustainable corporate success. A professional data protection strategy not only protects sensitive information, but also strengthens your customers' trust in your company.
Central recommendations for action:
Establish a systematic data protection management
Train your employees regularly
Rely on modern technology solutions for automation
Carry out regular security audits
Document all data protection measures seamlessly
The legally compliant implementation of data protection requirements requires expertise and continuous adaptation to new developments.
Act now
Invest in professional data protection – we will accompany you on this path. Jurata AG offers long-standing, legal expertise and produces a privacy policy tailored to your company.
