Data Protection When Outsourcing: Swiss nFADP Basics for SMEs

Delegating work to a remote assistant often means sharing personal data: client emails, contact lists, invoices, employee details. In Switzerland, that data is protected by the revised Federal Act on Data Protection, known as the nFADP (or revDSG in German), which took effect on 1 September 2023. If your assistant is based abroad, additional rules apply. This article gives SMEs a practical overview of what to think about before and during outsourcing.

Note: This article is general information, not legal advice. Data protection requirements depend on your specific situation. Please consult a qualified Swiss lawyer or data protection specialist before making decisions about your obligations.

What the nFADP covers

The nFADP applies to the processing of personal data about natural persons by private companies and federal bodies. “Processing” is broad: collecting, storing, using, disclosing or deleting data all count. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC, or EDÖB in German).

For an SME, this typically includes data about customers, prospects, suppliers’ contact persons and employees.

Controller and processor roles

When you outsource a task involving personal data, your business usually remains the controller: you decide why and how the data is processed. The outsourcing provider generally acts as a processor, handling data on your behalf and according to your instructions.

Under the nFADP, you may entrust processing to a processor if, broadly speaking:

• The processor only processes data as you yourself would be permitted to
• No legal or contractual confidentiality obligation prohibits it
• You ensure the processor is able to guarantee data security

Data processing agreements

A written data processing agreement (DPA) is the usual way to document this relationship. It typically sets out the scope and purpose of processing, the types of data involved, security measures, confidentiality, use of sub-processors, and what happens to data when the contract ends. NDAs are useful but generally do not replace a DPA.

Cross-border disclosure

This is the key issue when your assistant works from another country. The nFADP allows personal data to be disclosed abroad freely only where the Swiss Federal Council has determined that the destination country provides adequate protection. The Federal Council maintains a list of such countries.

The Philippines is not, at the time of writing, on that list. Disclosure to countries without adequate protection generally requires appropriate safeguards. A common option is to use standard contractual clauses recognised by the FDPIC, often based on the EU standard contractual clauses with Swiss-specific adaptations. Other mechanisms and narrow exceptions exist, but they should be assessed with professional advice.

Worth noting: giving a remote assistant access to data stored on servers in Switzerland or the EU can still count as a disclosure abroad, because the data is accessed from another country.

Records of processing activities

The nFADP requires controllers and processors to keep records of processing activities. There is an exemption for companies with fewer than 250 employees, unless they process sensitive personal data on a large scale or carry out high-risk profiling. Even where the exemption applies, a simple record of what data you process, why, where it goes and who has access is good practice and makes outsourcing decisions easier.

Data security measures

You are expected to ensure data security appropriate to the risk. When working with a remote assistant, practical measures include:

Measure	What it looks like in practice
Access control	Role-based permissions; the assistant sees only what the task needs
Credential management	A business password manager instead of shared passwords
Authentication	Two-factor authentication on all key accounts
Device standards	Updated operating systems, screen locks, antivirus
Confidentiality	Signed NDAs and clear data handling instructions
Offboarding	A checklist to revoke all access promptly when work ends

These are the kinds of practices we build into every placement; see how it works for details. None of them alone makes a business compliant, but together they reduce risk.

Breach notification

If a data security breach is likely to result in a high risk to the personality or fundamental rights of the people affected, the controller must notify the FDPIC as soon as possible. Processors must inform the controller of a breach as soon as possible. In some cases, the affected individuals must also be informed. Your DPA should set out how and how quickly your provider will notify you.

The duty to inform

When you collect personal data, you must inform the people concerned, typically through a privacy notice. If you disclose data abroad, the notice should generally state the countries involved and, where relevant, the safeguards relied upon. If you start outsourcing to the Philippines, review your privacy notice to see whether it needs updating.

A practical checklist for SMEs

1. Map which personal data your assistant will access.
2. Sign a data processing agreement with your provider.
3. Put appropriate cross-border safeguards in place, such as FDPIC-recognised standard contractual clauses.
4. Update your privacy notice.
5. Apply access controls, a password manager and 2FA.
6. Agree a breach notification process.
7. Review your arrangements regularly with a qualified adviser.

For more on structuring delegated work, see our administrative support service or read about how Swiss SMEs cut admin costs with a virtual assistant.

Key takeaways

• The nFADP has applied since 1 September 2023 and covers most personal data SMEs handle.
• Outsourcing usually makes your provider a processor; document this in a DPA.
• Disclosure to the Philippines generally requires safeguards such as FDPIC-recognised standard contractual clauses.
• Security measures, breach procedures and an updated privacy notice are all part of the picture.
• Always seek advice from a qualified Swiss lawyer for your specific situation.

Questions about how we handle data with our assistants? Book a free consultation and we will walk you through our practices.