# Ch ndsg compliance
> Source: https://legalcode.md/skills/legalcode-ch-ndsg-compliance | [HTML version](https://legalcode.md/skills/legalcode-ch-ndsg-compliance)

Switzerland revised Federal Act on Data Protection (nDSG / revDSG / FADP, SR 235.1, in force 1 September 2023) compliance assessment.

Switzerland revised Federal Act on Data Protection (nDSG / revDSG / FADP, SR 235.1, in force 1 September 2023) compliance assessment. Use when an organisation needs to determine nDSG applicability, assess compliance posture against processing principles, information obligations, DPIA requirements, breach notification to the FDPIC, cross-border transfer safeguards, data processing agreement requirements, and criminal sanction exposure. Covers: processing principles (Art. 6 nDSG), privacy by design/default (Art. 7), data security (Art. 8), processor contracts (Art. 9), ROPA (Art. 12), foreign representative (Art. 14), information obligations (Arts. 19–21), DPIA and prior FDPIC consultation (Arts. 22–23), breach notification threshold and timeline (Art. 24), data subject rights including access and portability (Arts. 25–28), cross-border transfers and Federal Council adequacy list (Arts. 16–17, Annex 1 DPO), criminal sanctions on natural persons (Arts. 60–62), cantonal law variations, and GDPR comparison for EU-facing operations. Produces compliance assessments with COMPLIANT/PARTIAL/NON-COMPLIANT/CRITICAL classifications, prioritised remediation roadmaps, FDPIC notification readiness checklists, and criminal liability exposure analysis. Jurisdiction: Switzerland (federal nDSG) with cantonal variation notes.

*(Bundesgesetz über den Datenschutz / Loi fédérale sur la protection des données / SR 235.1)* This skill assesses an organisation's compliance posture against the Swiss revised Federal Act on Data Protection (nDSG, in force 1 September 2023). It covers the full nDSG obligation stack for **private controllers and processors** operating in or toward Switzerland. **Covers:** - Applicability determination (private vs. federal body; extraterritorial scope; foreign representative obligation under Art. 14 nDSG) - Processing principles compliance: lawfulness, good faith, proportionality, purpose limitation, accuracy, storage limitation (Art. 6 nDSG) - Privacy by design and privacy by default (Art. 7 nDSG) - Technical and organisational security measures (Art. 8 nDSG; Arts. 1–7 DPO) - Processor contract (Auftragsbearbeitung) requirements (Art. 9 nDSG) - Record of Processing Activities (ROPA) obligation and SME exemption (Art. 12 nDSG) - Information obligations for direct and indirect data collection (Arts. 19–21 nDSG) - Automated individual decisions and profiling obligations (Art. 21 nDSG) - Data Protection Impact Assessment (DPIA) requirement and FDPIC consultation (Arts. 22–23 nDSG) - Security incident and breach notification to FDPIC — threshold, timeline, content (Art. 24 nDSG; Art. 15 DPO) - Data subject rights: access, rectification, portability — timelines and exceptions (Arts. 25–28 nDSG) - Cross-border ...

## Jurisdictions

Switzerland



---
*Legalcode -- legalcode.md*