Compliance · FADP
Data protection audit for Swiss SMEs
The Swiss Data Protection Act already applies to your SME. AlpenData maps your data and hands you a record of processing activities and a clear action plan, without legal jargon.
The most common data protection gaps in SMEs
Since September 2023, the revised Swiss Data Protection Act has imposed concrete obligations on almost every company. Many SMEs know it, but don't know where to start.
- 01
You don't know what data you hold
Client, HR, supplier, prospect data, video surveillance… It is scattered across tools that no one has a complete list of.
- 02
You have no record of processing activities
The Swiss Data Protection Act requires one for most companies. Without it, you cannot respond to an inspection or a client request.
- 03
Your sub-processors are not under contract
Your cloud tools, your payroll software, your IT provider process personal data, often without a compliant data-processing agreement.
- 04
Your data leaves the country without your knowing
Many SaaS tools host data outside Switzerland. The Swiss Data Protection Act strictly governs these transfers, and you are responsible for them.
Knowing where your data is, and where it goes
It all starts with the inventory: which personal data you process (customers, staff, suppliers, applicants) and where each is hosted.
What stays in Switzerland is simple to document. What goes abroad, often through a SaaS tool, has to be assessed: that is where most gaps hide.
From inventory to action plan, in four steps
No generic copy-paste checklist. We start from your actual situation, your tools and your data, to give you a concrete, prioritised path to improvement.
- 01
Data mapping
We identify all the personal data you process (clients, employees, prospects, suppliers) and where it is stored.
- 02
Record of processing activities
We build (or update) your record of processing activities, the central document required by the Swiss Data Protection Act.
- 03
Gap analysis
We compare your actual situation with the requirements of the Act: legal bases, retention periods, security, cross-border transfers, sub-processors.
- 04
Documented action plan
You receive a clear report with non-compliance issues sorted by priority and risk, and the concrete actions needed to fix them.
Audit deliverables and pricing
Audit deliverables
- A mapping of personal-data processing activities.
- A record of processing activities compliant with the Swiss Data Protection Act, ready to present.
- A gap report sorted by level of legal risk.
- A prioritised action plan, both technical and organisational.
- Templates: privacy policy, data-processing clauses, information notices.
How it is billed
Data protection audit, fixed fee
1,500 – 3,500 CHF
Depending on the size of your organisation and the number of tools to analyse. Fixed fee defined on request after a short scoping, with no minimum term.
A one-off IT Project
The audit is a fixed-fee engagement: you know the amount before we start.
See IT ProjectsCompliance over time
Security, backups and Swiss hosting then fit into AlpenCare managed IT.
See AlpenCare managed ITLocal data protection support, in French-speaking Switzerland
We support SMEs in Lausanne and throughout the canton of Vaud, and remotely in the rest of French-speaking Switzerland. A contact who speaks your language and knows the Swiss context.
- Chavannes-près-Renens Head office
- Lausanne 4 km
- Morges 6 km
- Vevey 22 km
- Yverdon-les-Bains 28 km
- Montreux 28 km
- Nyon 31 km
- Fribourg 54 km
km as the crow flies
Frequently asked questions about the data protection audit
Can’t find your answer?
Ask us your question01 Does the revised Swiss Data Protection Act really apply to my SME?
Yes. The revised Swiss Data Protection Act (FADP), in force since September 2023, applies to any company that processes personal data, which is the case for nearly all SMEs (clients, employees, suppliers). The size of the company does not exempt it from the basic obligations: information, security, and often a record of processing activities.
02 How is a data protection audit billed for an SME?
The data protection audit is an IT Project billed at a fixed fee, defined on request after a short scoping. Typically expect between CHF 1,500 and CHF 3,500 depending on the size of the company and the number of tools and processing activities to analyse. No hourly billing: the amount agreed at the outset is the final price, and there is no fixed-term commitment.
03 How long does a data protection audit take?
Expect about a week for a standard SME, between gathering information, analysis and writing the report. For more complex structures (multi-site, numerous SaaS tools), the timeframe is announced when the quote is issued.
04 Are you lawyers?
We are an IT provider, not a law firm. Our audit covers the technical and organisational aspects of compliance (mapping, security, record of processing, sub-processors, transfers). For purely complex legal questions, we work alongside your legal counsel, without replacing it.
05 What happens after the audit?
You receive the report and the action plan, and you are free. We can then implement the technical fixes (security, Swiss hosting, backups) as part of an IT Project or AlpenCare ongoing support. But nothing is imposed.
06 Is data protection compliance linked to hosting in Switzerland?
Largely. Keeping your data on Swiss infrastructure (such as Infomaniak) considerably simplifies the question of international transfers and reassures your clients. It is one of the most frequent recommendations of our audits, and one of our strengths.
First step
Request a data protection audit
A clear audit, a ready-to-use record of processing and a prioritised action plan. Request your quote, with no commitment.
David Cunha
Founder and technical director
Chavannes-près-Renens