Data recovery in Switzerland: how to verify your provider

Read the legal notice, not the homepage

The legal notice (impressum) identifies the operator of the website. The counterparty to your contract, however, is designated by the general terms and conditions or the contract: the two do not always coincide, so check both. A .ch website can be operated by a company registered in another country: it is written there, but at the bottom of the page.

Check the company on Zefix.ch: free and official

The central commercial register (zefix.ch) tells you in ten seconds whether the company is registered in Switzerland, in what legal form, since when, and who represents it. Registration is not compulsory for all activities (a sole proprietorship below a certain turnover may not appear); but without registration you cannot verify the entity through this official channel, and that is in itself a piece of information.

Look for the place of jurisdiction in the terms and conditions

The place of jurisdiction designates the competent court in the event of a dispute. Read the relevant clause before sending in your device: it also states the law applicable to the contract. Its scope is not absolute: it depends on the applicable mandatory rules, particularly for consumer contracts. It nevertheless indicates where, and under which law, the provider intends to have disputes settled.

Look for the transfer and subcontracting clause

This is the clause that authorises sending your device to partner laboratories or subcontractors, sometimes with no geographical limit. Smartphones, memory chips and complex RAID configurations are the devices most frequently concerned.

Distinguish what is verifiable from what is merely claimed

A cleanroom with an ISO class, a certification, a success rate: ask for the certificate, the issuing body, the scope and the validity date. A “no data, no fee” guarantee may come with exceptions in the terms and conditions (analysis fees, express options, certain types of cases): read the exact conditions.

Healthcare: doctors, hospitals, pharmacies, laboratories

Patient data is sensitive personal data (Art. 5 let. c FADP) and is covered by medical secrecy (Art. 321 Swiss Criminal Code), which also extends to the professional's auxiliaries.

IT service providers may, depending on the circumstances, qualify as auxiliaries within the meaning of Art. 321 Swiss Criminal Code. Using a provider or a subcontracting chain abroad is not automatically prohibited, but it requires reinforced analysis: professional secrecy, data access, contractual commitments, applicable law and the FADP's rules on international transfers. For patient data, the FDPIC notably recommends, as a precaution, avoiding a cloud provider abroad.

Banks and institutions supervised by FINMA

Banking secrecy (Art. 47 Banking Act) makes the disclosure of client data a criminal offence. Depending on the nature and importance of the engagement, FINMA's prudential rules on outsourcing (FINMA Circular 2018/3) may also be relevant: the institutions concerned must in particular ensure adequate risk management and sufficient control and audit rights and, where processing takes place abroad, take into account the additional risks associated with that location.

Lawyers and notaries

Art. 321 of the Swiss Criminal Code protects the professional secrecy of lawyers and notaries, and Art. 13 of the Lawyers Act (LLCA) requires lawyers to ensure that their auxiliaries respect it. An entirely Swiss processing chain, with no access from abroad, in principle avoids the issue of international data transfers; the contracting party, the applicable law and the place of jurisdiction must nevertheless be checked separately, and the professional remains bound to check the provider's confidentiality and security commitments. For fiduciaries and other accounting professions, obligations may arise in particular from the FADP, from the contract and, depending on the activity carried out, from other sector-specific rules.

Public administrations, municipalities, schools

Official secrecy (Art. 320 Swiss Criminal Code) and cantonal data protection laws apply to public bodies. Using a foreign entity may impose additional requirements or, depending on the applicable legislation and the nature of the data, limit the solutions that can be used: compliance must be analysed case by case (authority concerned, cantonal law, type of data, contractual and security guarantees, country of destination).

Sensitive federal engagements

Since 1 January 2024, the Information Security Act (ISA) has governed the processing of classified federal information. Where an engagement involves a sensitive activity, it goes through the company security procedure (PSE), which may result in a company security declaration (DSE).

Tesweb SA has completed the company security procedure (PSE) and holds a company security declaration (DSE). The employees who handle these engagements and access the secured laboratory hold “SECRET” level clearance issued by the State Secretariat for Security Policy (SEPOS). The document can be presented on request in the context of an engagement.

All companies: the FADP

Since 1 September 2023, the revised FADP has governed the disclosure of personal data abroad (Art. 16-17). It may notably rely on the recognition of an adequate level of protection or, failing that, on the safeguards provided for by law; Art. 17 also provides for certain exceptions in specific situations. The controller must furthermore keep control of its subcontracting chain (Art. 9): a processor may only engage another processor with the controller's prior authorisation; that authorisation may be general, in which case the processor must announce any change so that the controller can object.

Certain intentional breaches of FADP obligations, in particular of duties of care relating to subcontracting, security or the disclosure of data abroad, are criminally sanctioned; the maximum penalty under the FADP is a fine of CHF 250,000 and is aimed primarily at the responsible natural person (Art. 60 et seq. FADP).