FADP Compliance for Life Sciences
Achieve full compliance with the Swiss Federal Act on Data Protection (FADP) and its related Federal Ordinance on Data Protection (FODP) through tailored services for the Life Sciences sector.
The revised Swiss Federal Act on Data Protection (FADP) came into force in September 2023, together with its Ordinance, introducing stricter rules for the collection, use, and protection of personal data in Switzerland. It applies to any organization that processes the personal data of Swiss residents, regardless of the company’s location and to companies established in Switzerland.
For Life Sciences organizations handling sensitive health data, clinical trial records, or genetic information, FADP compliance, and its interpretation with other clinical legislation, is essential to maintain trust and avoid regulatory sanctions. At MyData-TRUST, we support your teams with expert services designed to align your operations with FADP, clinical legislation, and related international standards.
What Is the Swiss FADP?
The FADP is Switzerland’s Federal Data Protection law for private entities, revised to align more closely with the EU GDPR and the modernized Convention 108. It enforces transparency, accountability, and security in data processing and grants individuals stronger rights over their personal data.
Even though Switzerland is not part of the EU, many Life Sciences companies choose to comply with both the FADP and GDPR to ensure uninterrupted operations in the European and Swiss markets.
Key FADP Compliance Requirements
- Data Protection Principles: Ensure your processing activities are aligned with these principles, such as lawfulness, good faith and proportionality, purpose limitation and accuracy.
- Transparency: Inform individuals clearly about how their data is collected and used
- Data Subject Rights: Enable access, rectification, deletion, portability and processing restrictions
- Security Measures: Implement technical and organizational safeguards and the principles of data protection by design and by default
- DPIAs: Conduct Data Protection Impact Assessments for high-risk data processing
- Cross-border disclosure: Comply with restrictions for the international transfers of personal data
- Data breach notification: Notify the authority and the affected individuals in case of a personal data breach in accordance with the requirements of the FADP
- Records of processing activities: Controllers and processors shall maintain records with key aspects of their processing activities
- Data Protection Representative: For those controllers with domicile abroad
What Is a Data Protection Advisor (DPA)?
While the FADP does not mandate the appointment of a Data Protection Advisor (DPA), under certain circumstances it is mandatory. Furthermore, the Federal Data Protection and Information Commissioner (FDPIC) strongly recommends it.
Responsibilities of a DPA
- Respond to data subject requests in accordance with Swiss law
- Liaise with the FDPIC in case of audits or investigations
- Develop and maintain your internal compliance framework
- Promote awareness and training within your teams
- Examines the processing of personal data and recommends corrective measures if a breach of the data protection regulations is established
- Advises the controller on preparing the data protection impact assessment and reviews its implementation
Swiss FADP Services by MyData-TRUST
- Regulatory Gap Assessment
- DPIAs for high-risk activities
- Outsourced DPA services
- Data Subjects Requests and Data Breaches Management
- Records of Processing Activities
- Data Protection Representative
- Awareness training for your staff
- Legal support and documentation review
We work hand-in-hand with your teams to implement efficient, compliant, and risk-based privacy practices tailored to the Life Sciences environment.
Why Choose MyData-TRUST?
- In-house legal and operational experts familiar with Swiss and EU regulations
- Experience supporting Life Sciences organizations in Switzerland
- Sector-specific services for clinical research, biotech, and pharma companies
- Alignment with Human Research Act, Cantonal Data Protection Acts, Convention 108 standards, and Global privacy requirements.
Frequently asked questions
What is the Swiss FADP and who must comply?
The FADP is Switzerland’s federal Data Protection law. It applies to any foreign organization that processes the personal data of individuals residing in Switzerland or to companies established in that jurisdiction.
Is it mandatory to appoint a Data Protection Advisor (DPA)?
It is optional unless the DPA is granted the authority to assess high-risk DPIAs. However, given the complexity of the data protection landscape in Switzerland in the Life Science sector, appointing a DPA is strongly recommended. A DPA helps maintain compliance, manage data subject rights, and liaise with the Swiss regulator (FDPIC) and is the point of contact for data subjects.
What are the similarities between the FADP and GDPR?
Both laws enforce transparency, data subject rights, DPIAs, and accountability. However, there are nuances specific to Swiss law that must be considered independently.
How can MyData-TRUST support your FADP compliance?
We offer external DPA services, gap assessments, DPIAs, legal support, records of processing activities, and training specific to Life Sciences and Swiss regulatory expectations.
Need more information about MyData-TRUST? Get in touch with our experts.
MyData-TRUST offers global coverage
