Data Breach Impact Assessment Template for Switzerland

When your organization experiences a data breach in Switzerland, you need to conduct a comprehensive impact assessment that complies with the Swiss Federal Data Protection Act (revFADP/nDSG) 2023. This document evaluates the severity of the incident, determines your legal obligations, and guides your response strategy while ensuring compliance with Swiss data protection requirements.

When do you need this document?

You must prepare a Data Breach Impact Assessment whenever personal data in your organization has been accidentally or unlawfully destroyed, lost, altered, or disclosed without authorization. This includes cyberattacks targeting customer databases, employee records being accidentally sent to wrong recipients, laptops containing personal data being stolen, or unauthorized access to your systems by internal or external parties. The assessment becomes critical when the breach is likely to result in high risk to the rights and freedoms of affected individuals, requiring notification to the Swiss Federal Data Protection and Information Commissioner (FDPIC) within 72 hours.

Key legal considerations

Your assessment must evaluate several critical factors under Swiss law. First, determine the nature and scope of compromised data, including whether it involves sensitive personal data such as health records, biometric data, or financial information. You need to assess the potential consequences for affected individuals, considering risks like identity theft, financial fraud, or reputational damage. The document must outline your immediate containment measures and long-term remediation plans. Additionally, you should evaluate whether the breach triggers notification obligations to data subjects themselves, particularly if high risk to their rights cannot be mitigated through technical and organizational measures. For organizations dealing with EU residents' data, you must also consider parallel GDPR obligations and potential cross-border notification requirements.

Legal requirements in Switzerland

Under the Swiss Federal Data Protection Act 2023, you must notify the FDPIC of any data breach likely to result in high risk to personality rights or fundamental rights of data subjects. This notification must occur as soon as possible and no later than 72 hours after becoming aware of the breach. Your impact assessment must include specific details required by law: description of the breach nature, categories and approximate numbers of affected data subjects, likely consequences of the breach, and measures taken or proposed to address the incident. If your organization operates in the financial sector, additional requirements under FINMA circulars may apply. You must also consider obligations under the Swiss Criminal Code if the breach involves unauthorized data access or system intrusion. The assessment should document your decision-making process regarding data subject notification, as Swiss law requires direct notification when high risk cannot be mitigated and clear information must be provided to affected individuals.