The revised DPA provides for a new requirement to keep a register containing an inventory of all processing activities. An exemption is available for SMEs with less than 250 employees, unless they process sensitive data on a large scale or engage in high risk profiling.

In the event a data security breach is likely to result in a high risk to the personality or fundamental rights of the data subject, the data controller must now report the breach to the Federal Data Protection and Information Commissioner (FDPIC) without delay. In certain cases, a specific duty to notify the data subject is provided for. These reporting obligations apply to financial institutions in addition to the obligation to report cyberattacks to FINMA.

The data controller is required to disclose information to users regarding the recipients of subcontracted data. Prior consent of the data controller is required in the event of further subcontracting to a third party.

The revised DPA introduces a new duty to inform data subjects when their data are transferred abroad. Information shall now be provided on (i) the name of the receiving state or international organization, as well as, as the case may be, (ii) the applicable guarantees or (iii) the available exemption as provided by the law. Furthermore, the list of countries offering an adequate level of protection is now provided in the Annex to the implementing Ordinance (“revDPO”).

The new DPA significantly extends the data controller’s duty to inform the individuals whose data are being collected. Consequently, data subjects are granted an extended right of access to their data, subject to new exemptions which may apply to companies, notably to prevent abuse of rights. 

Furthermore, a specific extended information duty is introduced for automated decisions, when such decisions produce legal effects or significantly affect the data subject. 

Moreover, the DPA provides for a new right to data portability, allowing data subjects to obtain their personal data or to have them transferred to another data controller.

When the data processing presents a high risk for the personality or fundamental rights of the data subject, an impact assessment must be conducted. Situations in which data processing is required by virtue of a legal obligation, such as those arising from the anti-money laundering legislation, are reserved. The impact assessment must include a description of the contemplated processing, an assessment of the risks involved and the measures undertaken to mitigate these risks.

Financial institutions are under an obligation to document their data treatment process. To this end, they are required to establish a Privacy Policy, and to put in place internal guidelines on data privacy and security as well as on data processing by employees (e-mails, etc.). In addition, a Processing Regulation must be implemented, if large scale processing of sensitive data or high risk profiling is involved.