Has your rent been raised? Find out more about your rights

The nine principles of the revised Data Protection Act

The nFADP, which enters into force on 09.01.2023, includes various principles governing the processing of personal data in Switzerland.

The answer in detail

The nine data protection principles that must be complied with in every case of data processing are:

  1. Lawfulness / good faith: Personal data may only be processed in a lawful way and according to the principle of good faith.
  2. Proportionality: The processing of data must be reasonable. In other words, the data must be required for the purpose, appropriate, and objectively suitable. 
  3. Transparency and purposeful: Personal data may only be gathered and processed for a specific purpose that is recognizable for the person affected. 
  4. Storage: As soon as the personal data fulfill the intended purpose, it must be destroyed (deleted) or anonymized.
  5. Data integrity: If you process personal data, you must be sure of its correctness and take all appropriate measures to correct incorrect or incomplete data, or to delete or destroy it.
  6. Consent: If consent is required from the person affected, then this consent is only valid if it was granted voluntarily for one or multiple instances of data processing and after the person has been informed adequately. In particular, this applies to the processing of especially sensitive data and high-risk profiling. 
  7. Data security: Personal data must be protected against unauthorized processing by means of technical and organizational measures (privacy by design). You are also obligated to ensure through default settings that the processing of personal data is limited to the minimum scope necessary for the purpose of use provided the person affected has not specified otherwise (privacy by default).
  8. Will of the affected person: Personal data may not be processed against the will of the affected person without justification.
  9. Disclosure to third parties: Especially sensitive personal data may not be disclosed to third parties without justification or the consent of the affected person.

Further legal tips on the subject of data protection or data processing: