New Swiss DPA: evidence can open the market

The contract looked close. The product met the need, the price had been accepted and the sales team knew the next step. Then the buyer's questionnaire arrived: which personal data is processed, in which countries, by which processors, for how long, and who decides after a breach? The privacy notice existed, but the answers were scattered across business teams, IT, the cloud provider and management. Since 1 September 2023, Switzerland's revised Federal Act on Data Protection has required businesses to understand how processing works in practice. The issue is broader than compliance. For a B2B provider, clear evidence can reassure a buyer, shorten supplier onboarding or make a demanding market more accessible. This reading follows one customer-data process from mapping to decision. It then shows how getfishnet would assess a trust-led acquisition strategy without turning a legal duty into a sales promise.

The new Swiss DPA requires a business to explain its data processing, assign responsibility and evidence the measures taken. It is neither just a privacy notice nor a project that ended when the law entered into force.

Parliament adopted the fully revised act on 25 September 2020. The new law and its implementing ordinances entered into force on 1 September 2023. The Federal Office of Justice describes the reform as an adaptation of data protection to digital use and growing cross-border flows.

Three years later, the date remains a reference point but says nothing about a company's current position. A new CRM, employee portal, cloud provider, prospecting system or AI feature can change the data collected, recipients and risk. The useful question is not “did we prepare for September 2023?” but “can we explain the processing running today?”

The Federal Data Protection and Information Commissioner, the FDPIC, highlights duties to provide information, access rights, data protection by design and by default, and the reporting of selected breaches. These do not apply identically to every case. They are control points to connect with the purpose, data, people, systems, suppliers, countries, retention, risks and decision.

Map the activity that combines a real change, a near-term decision and enough risk to mobilise the business. Starting with one defined flow avoids an abstract inventory that produces neither action nor usable evidence.

Consider a services company replacing its sales-management system. The new tool will hold prospect details, interaction histories, qualification notes and perhaps partner data. External providers will handle some hosting and support. The project has a budget, decision date and identifiable owners, making it a better starting point than a general review of every document.

How to read the diagram. Data does not belong to IT merely because it sits in software. The business defines its use, technical teams control part of the operation, providers perform governed tasks and management owns decisions that exceed one team's authority.

Mapping follows the data, not the organisation chart. It begins when information enters the process and ends when it is deleted, returned or anonymised. At each stage it links an action to an accountable person and accessible evidence.

In its cloud-computing guidance, the FDPIC states that the customer remains responsible for compliance when processing is entrusted to a cloud provider. The customer must review processor terms, disclosures abroad, security, subprocessors and support for requests or incidents. The contract is evidence within the map, not a substitute for it.

The map should connect purpose, systems, recipients, retention, security and decision-makers. An application list is inadequate if it cannot explain why processing exists and who can change it.

An actionable file answers seven questions, each tied to a decision rather than a pile of documents.

Mapping often exposes a difference between stated practice and system behaviour. A retention period may be written but not configured. A supplier may be known while its subprocessors are not. A named owner may lack authority to stop the processing.

Evidence need not be a long report. It may be a contract, setting, log, dated decision or test. Its value comes from the link between the observed fact, the decision owner and the next action.

Data protection by design brings minimisation, access, retention and security into the project before launch. Default settings should restrict processing to what is necessary for the stated purpose.

Article 7 DPA places data protection within service design. The FDPIC's cloud guidance makes the consequence clear: if the standard service cannot control the risks, the business must find suitable safeguards, choose another solution or avoid that outsourcing arrangement.

For the CRM, ask practical questions. Are all free-text notes necessary? Should a salesperson see another region's records? Should inactive contacts remain accessible indefinitely? Can a full export be downloaded without an alert? What happens to an employee account when its user leaves?

The project gains a decision sequence: remove unnecessary data, restrict access, set retention, document suppliers, test sensitive operations and prepare for incidents. Compliance becomes visible because it changes the product and its operation.

A processing register or impact assessment is required when the DPA's conditions are met. Its operational value begins earlier, as soon as important processing can no longer be explained, documented or decided reliably.

A record of processing activities organises purposes, categories of people and data, recipients, retention and security measures. Exceptions for selected private companies mean it is not a universal requirement without a case review. Even where an exemption may apply, proportionate mapping helps manage a project, answer a customer or handle an access request.

A data protection impact assessment applies where planned processing is likely to create a high risk to personality or fundamental rights. It describes the project, assesses risk and examines measures. The FDPIC also notes that appointing a data protection adviser is optional for private companies, subject to specific conditions where they seek the DPA's impact-assessment facilitations.

Commercially, a provider should not sell a heavy assessment merely because a keyword appears. It first identifies the processing, risk, existing work and required decision. A short assignment may reveal a deeper need or avoid a disproportionate audit.

The controller decides after a data security breach, using technical facts, the context of affected people and a risk assessment. The processor must notify the controller promptly and provide available information; it does not replace the controller's decision.

Under Article 24 DPA, a breach likely to result in a high risk to personality or fundamental rights must be reported to the FDPIC as soon as possible. Affected people must also be informed where necessary for their protection. FDPIC guidance published on 23 April 2025 distinguishes the high risk that triggers reporting from the protective need that can justify informing individuals.

How to read the diagram. Urgency does not justify a fact-free decision. Technical teams document the event, the business explains the use of the data, the competent function prepares the assessment, and the controller records the decision and reasons.

The FDPIC's 33rd activity report for 2025/2026 records more than 2,000 reports of potential data protection breaches, 156 interventions with controllers, 22 preliminary examinations and 9 investigations during the reporting year. These categories are not a sales funnel and do not measure every Swiss incident. They do show a functioning supervisory practice.

Prioritisation combines potential impact with the evidence gap. Important but well-controlled processing does not require the same urgency as a sensitive, poorly documented flow tied to an imminent decision. The method selects the next effort; it does not deliver a legal verdict.

The indicative matrix below can support a first workshop. Each organisation must justify its criteria; a point's position cannot determine legal status.

Consider sensitivity, volume, affected people, recipient count, foreign disclosures, operational dependency, approaching changes and evidence quality. The score makes judgement explicit; it does not replace it. “Act now” needs an owner, deadline and decision. “Improve the evidence” may need limited documentary or technical work. “Review and monitor” needs a targeted check. “Maintain simply” does not justify a heavy assignment.

DPA evidence can support market access when a buyer, partner or contracting authority must assess a supplier before entrusting it with data. Evidence reduces documentable uncertainty but never guarantees onboarding or a sale.

In B2B relationships, trust often becomes verifiable material: flow map, supplier list, security measures, retention rule, incident procedure, roles and request handling. The law promises no contract in return. Missing answers can, however, prolong evaluation, generate further questions or prevent approval.

The National Cyber Security Centre's 2025 annual report stresses secure supply chains. That is a broader cybersecurity finding, not proof that every DPA control is a purchasing requirement. It nevertheless reflects a shift: suppliers are assessed not only on their product but on the dependencies and risks they introduce.

The related reading on reporting cyberattacks against critical infrastructure also distributes facts across technical teams, the business and management, but follows a different trigger and authority.

getfishnet would begin with target markets, the evidence buyers actually request and the partner's ability to deliver a useful first output. The strategy would remain a test, never an executed campaign or assured result.

First, identify a specific commercial moment: tender, supplier onboarding, entry into a regulated sector or major-account request. A legal duty without a buyer, deadline or deliverable is not yet an acquisition opportunity.

Then separate three offer levels: a short blocker diagnostic; implementation of priority evidence; and follow-up only where new projects or suppliers regularly create decisions. Finally, test the proposition with a partner who can promptly define scope, timing, exclusions and capacity.

Channel choice follows the moment when evidence becomes decisive. Search, account prospecting, phone, email, professional networks, partners, events and content can play complementary roles. No channel is retained by habit or judged on contact volume alone.

Search may reveal an existing request. Targeted outreach reaches suppliers pursuing demanding buyers. Legal, cyber, cloud, insurance and software partners may detect change earlier. Events and content make observed objections easier to understand.

How to read the diagram. Every channel feeds the same qualification. The first useful measure is not a click or meeting but the share of cases where real processing, missing evidence and a commercial decision coincide.

Acquisition cost includes media, data, tools, production and human time. Compare it with attributable margin, collection time and delivery capacity. Without those measures, getfishnet proposes a test, not a return.

Before execution, only decision thresholds can be modelled: accessible account pool, genuinely qualified cases, initial-deliverable value, maximum acquisition cost, monthly capacity and collection time. These are assumptions to replace with measurements, not observed performance.

A cautious, central and maximum-capacity scenario can each start with accessible accounts and end with assignments the partner can deliver. Response and close rates remain unknown until testing.

This prevents two errors: treating the FDPIC's 2,000-plus reports as leads, and presenting the total value of an expected contract as acquisition revenue. Only signed, collected and attributable revenue can validate the model after execution.

Recurring revenue is justified when new projects, suppliers, processing activities or buyer requirements create regular decisions for the partner to prepare and follow. Automatic updates without useful work do not form a durable offer.

Follow-up may cover changes, subprocessors, buyer questionnaires, incident exercises or impact assessments. Its scope states what is reviewed, who decides and what is delivered. The client must name owners, report changes and make decisions; an external partner cannot sustain governance alone.

The Swiss IT and cybersecurity market page separates data protection, operational security and reporting duties.

Map one real processing activity before discussing compliance or acquisition. If the map exposes missing evidence that blocks a commercial decision, getfishnet can then assess a market-development strategy with a competent partner.

The new DPA provides a demanding framework. Commercial trust adds a growth issue only where a buyer genuinely expects evidence and the business can produce it. This reading certifies no organisation and promises no sale. It shows how to turn a broad concern into a verifiable case, then decide whether that case merits a multichannel acquisition test.