The operational obligations side by side
| Obligation | FADP | GDPR |
|---|---|---|
| Record of processing activities | Art. 12; exemption below 250 employees (Art. 24 DPO) | Art. 30; exemption below 250 employees, narrowly limited |
| Duty to inform | Art. 19 | Art. 13 and 14 |
| Right of access | Art. 25; generally 30 days | Art. 15; one month, extendable by two months |
| Data release and portability | Art. 28 | Art. 20 |
| Erasure | Art. 6 para. 4 and Art. 32 para. 2 let. c | Art. 17 |
| Data protection by design and by default | Art. 7 | Art. 25 |
| Data security | Art. 8 | Art. 32 |
| Data protection impact assessment | Art. 22 | Art. 35 |
| Notification of data security breaches | Art. 24; to the FDPIC as soon as possible if a high risk is likely | Art. 33; to the supervisory authority without undue delay, where feasible within 72 hours, unless the breach is unlikely to result in a risk |
| Disclosure abroad | Art. 16 and 17 | Art. 44 et seq. |
Where the FADP and the GDPR differ
- Terminology: the German-language versions use different terms – “Personendaten” instead of “personenbezogene Daten”, “Bearbeitung” instead of “Verarbeitung”, “Auftragsbearbeiter” instead of “Auftragsverarbeiter”. In English, both refer to personal data, processing and processors.
- Basis for processing: the FADP permits processing if the principles are observed; a justification is only required in the event of a violation of privacy. The GDPR requires a legal basis for every processing operation (Art. 6 GDPR).
- Sensitive personal data: the FADP also includes data on social assistance measures and on administrative and criminal proceedings or sanctions.
- Breach notification: the FADP requires it where a high risk is likely, without a fixed deadline; the GDPR requires it as soon as a risk cannot be ruled out, where feasible within 72 hours.
- Sanctions: the FADP generally directs fines at responsible natural persons, the GDPR imposes fines on companies.
What does this mean for day-to-day operations?
Both laws require processes, not just documents: a register that is accurate, requests that are answered on time, data that is actually deleted once its period has expired, and proof that this has happened.
If you are subject to both legal systems, a single process works best: calculate and monitor deadlines for each request, orchestrate deletions across all systems, record every step.