Why the place of operation matters
A search for personal data reads content. An access request collects all of a person's data. Deletion orchestration knows all systems and their dependencies. If such software runs at the provider, the provider becomes a processor (Art. 9 FADP, Art. 28 GDPR) – often with data stored abroad (Art. 16 FADP).
In regulated industries, there are also supervisory requirements, such as FINMA's requirements for outsourcing at banks and insurers. Public bodies are also subject to cantonal data protection laws.
Software as a service or running it yourself – a comparison
| Criterion | Software as a service at the provider | Running it yourself |
|---|---|---|
| Location of data | at the provider | in your environment |
| Processing on behalf | contract with and oversight of the provider required | not applicable to the vendor; for a cloud provider or operating partner, their contract applies |
| Disclosure abroad | depends on the provider | none added by the vendor; depends on where you operate |
| Connection of internal systems | via the internet | within your own network |
| Operation and updates | by the provider | by your IT or your operator, with support from the vendor |
What matters when running it yourself
- Operation in containers with widely used standard tools instead of special infrastructure.
- Sign-in via your own identity provider with single sign-on.
- Roles, approvals and an audit trail, so that it remains traceable who did what.
- No connection to the vendor without your approval – no telemetry, no licence server.
- Multi-tenancy, when several companies or customers must remain separate.
- Predictable updates that do not disrupt day-to-day operations.
Who this matters most to
For insurers and pension funds with legacy core systems, for regulated banks, for hospitals with patient data, for public administration and for IT service providers working on behalf of several customers. What they have in common: personal data should not leave their premises.