Competencies Archive | Pragmatica AG Ihre Boutique Managementberatung seit über 25 Jahren. Fri, 31 Jul 2026 09:23:04 +0000 en-US hourly 1 https://wordpress.org/?v=7.1 GDPR with a “Swiss finish”: What companies need to know about the revised Data Protection Act https://www.pragmatica.ch/en/gdpr-with-a-swiss-finish/ Fri, 20 Jan 2023 23:22:00 +0000 https://www.pragmatica.ch/dsgvo-mit-swiss-finish-was-unternehmen-ueber-das-revidierte-datenschutzgesetz-wissen-muessen/ GDPR with a “Swiss finish”: What companies need to know about the revised Data Protection Act WHAT YOU NEED TO KNOW NOW The most important changes to the revised DPA at a glance With the adoption of the revised Data Protection Act (rDPA) by parliament in September 2020, the legislative process is complete and the […]

Der Beitrag GDPR with a “Swiss finish”: What companies need to know about the revised Data Protection Act erschien zuerst auf Pragmatica AG.

]]>

GDPR with a "Swiss finish": What companies need to know about the revised Data Protection Act

  • WHAT YOU NEED TO KNOW NOW

The most important changes to the revised DPA at a glance

With the adoption of the revised Data Protection Act (rDPA) by parliament in September 2020, the legislative process is complete and the revised Data Protection Act will enter into force on September 1, 2023 without a transitional period. In this article, we discuss the most important changes, provide a comparison with the European GDPR and show where companies may need to take action.

The revised DPA pursues a risk-based approach

Companies are increasingly processing data about customers, suppliers and employees. The aim of the revision is to oblige companies to take the necessary organizational and technical measures to ensure data security and prevent data misuse as far as possible.

The most important innovations at a glance

New scope of application: Natural persons

One of the key changes concerns the scope of the revised law. While the DPA of 1992 applies to the data of both legal entities and natural persons, the revised DPA will only apply to the data of natural persons from September. Foreign companies operating in Switzerland must also meet the requirements. This aligns the scope of application with the European GDPR.

Data Protection Officer: Voluntary but recommended

The main role of the data protection advisor, in addition to being the point of contact with the supervisory authority (FDPIC), is to comply with any requests for information and to train employees accordingly. It therefore corresponds to the role of the Data Protection Officer (DPO) in the GDPR. In contrast to the GDPR, however, the rDSG does not require private-law organizations to appoint a DPO. However, this voluntary nature may, under certain circumstances, be associated with extended requirements and thus increased effort in dealing with the stately supervisory authorities (FDPIC).

Data processing directory and data protection impact assessment (DPIA)

Companies are now obliged to keep a data processing register. However, there are exceptions for SMEs with fewer than 250 employees whose data processing entails a limited risk. In particular, the data processing directory must contain information about the processing of personal data abroad. In contrast to the GDPR, however, the DPA does not contain any comprehensive formal requirements for the data processing directory.

Companies must also introduce a data protection impact assessment (DPIA) process. There is also a specific list of processing activities for which a DPIA is mandatory, such as the processing of sensitive personal data, the processing of data for the purpose of surveillance, the processing of large amounts of personal data, the processing of personal data in connection with automated decision-making, etc.

The revised Data Protection Act introduces personal criminal liability

While the European GDPR provides for fines against companies, under the new Swiss DPA the responsible employees can be held criminally liable. The violation of data protection information, disclosure and cooperation obligations can be punished with fines of up to CHF 250,000. The consequences of breaching the duty of care, professional confidentiality and disregarding orders are also regulated – all of which are also punishable by fines of up to CHF 250,000.

Another new regulation worth mentioning is the extension of the previous duty of confidentiality for specific professional groups (lawyers, doctors, etc.) to a general duty of confidentiality for all professionals. While the obligation to maintain confidentiality of personal data was previously usually limited to the employer’s business and manufacturing secrets, the new regulation also obliges employees to maintain confidentiality with regard to the employer’s customer data. Violations of the provisions may result in fines of up to CHF 250,000 for the natural person responsible.

These regulations represent a significant tightening of the previous legislation and it is therefore necessary to train the employees concerned accordingly.

Requests for information and rights of natural persons concerned

The rDSG also defines rights and requirements in relation to requests for information from natural persons, which must be answered within 30 days. These include:

  • Right of access: Data subjects have the right to obtain from the controller information about the personal data concerning them and about the origin, recipients and purposes of the processing.

  • Form and scope: The information must be provided in a clear and comprehensible form and may only contain the necessary information.

  • Timing: The person responsible must respond to the request for information within 30 days.

  • Security measures: The person responsible must take appropriate security measures to ensure that the information is only provided to the authorized person.

  • Right to rectification, erasure and restriction: Data subjects have the right to have inaccurate data rectified or erased or to have the processing of their data restricted.

It is important to note that there may be exceptions to these requirements in certain cases, e.g. if the provision of information would adversely affect the rights and freedoms of other persons or if it concerns internal business information. In addition,unlike the GDPR, the rDSG does not stipulate that electronic requests for information must be made available free of charge.

COMPARISON WITH THE GDPR

Alignment, but not identical: differences between the rDSG and the European GDPR

OUR EXPERTS ARE THERE FOR YOU

Pragmatica supports the planning and implementation of the new data protection guidelines

We contribute all our experience from numerous past mandates in the context of channel and experience management as well as video consulting. We support you in the development, definition, planning and implementation of an omni-channel strategy and show you how you can achieve a great deal with small investments, for example in your video consulting skills. Contact info@pragmatica.ch for a non-binding exchange with us

Further topics

,

Digital Onboarding in Banking

to the article ➞

,

Process Mining and AI: Webinars I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

Der Beitrag GDPR with a “Swiss finish”: What companies need to know about the revised Data Protection Act erschien zuerst auf Pragmatica AG.

]]> Revision FINMA RS Operational Risks Banks: The most important changes https://www.pragmatica.ch/en/revision-finma-rs-operational-risks-banks/ Tue, 15 Nov 2022 23:45:00 +0000 https://www.pragmatica.ch/revision-finma-rs-operationelle-risiken-banken-die-wichtigsten-neuerungen/ Revision FINMA RS Operational Risks Banks: The most important changes. Latest news Close the gap On December 13, 2022, FINMA published Circular RS 2023/01 Operational risks and resilience of banks. It comes into force on January 1, 2024 and replaces the previous RS 2008/21. RS 2023/01 also adopts the existing requirements Principles for the Sound […]

Der Beitrag Revision FINMA RS Operational Risks Banks: The most important changes erschien zuerst auf Pragmatica AG.

]]>

Revision FINMA RS Operational Risks Banks: The most important changes.

  • Latest news

Close the gap

On December 13, 2022, FINMA published Circular RS 2023/01 Operational risks and resilience of banks. It comes into force on January 1, 2024 and replaces the previous RS 2008/21. RS 2023/01 also adopts the existing requirements Principles for the Sound Management of Operational Risk (PSMOR) and Principles for Operational Resilience (POR). In this article we summarize the most important changes.

Principle 1 – General requirements for the management of operational risks

The revision contains a significantly expanded specification of the roles for assessing the effectiveness of measures and the minimum scope of reporting in connection with operational risks. This is primarily intended to counter the misinterpretations frequently identified in practice in the previous FINMA RS 08/21. Institutions that already consider ICT and cyber risks as well as risks relating to critical data in their operational risk management should have little need to adapt.

Principle 2 – Management of ICT risks

The revision replaces the previous Principle 4 “Technology infrastructure”. This will largely be replaced by the requirements of the BCBS, which already reflects FINMA’s supervisory practice. This relates in particular to the formulation of incident management in coordination with the areas of disaster recovery (DR) and business continuity management (BCM), as well as regular reporting. Another new feature is the anchoring of the duty to report significant disruptions in accordance with FINMASA Art. 29.

Principle 3 – Management of cyber risks

This principle primarily contains clarifications of existing supervisory practice and defines the roles, responsibilities and processes for the collection, assessment and documentation of cyber risks, as well as regular reporting. These significant changes relate to the anchoring of the reporting obligation in accordance with FINMASA Art. 29 and the requirement to conduct scenario-based cyber exercises.

Principle 4 – Managing the risks of critical data

The current FINMA RS 08/21 primarily defines the requirements for the protection of electronic client data. This definition is extended in the revision and is intended to apply to all data classified as critical in terms of confidentiality, integrity or availability. The provisions also include the selection, training, monitoring and regular review of privileged access, as well as the implementation of a role and function-specific authorization system.

These requirements largely correspond to security practice today and many institutions have probably already implemented corresponding measures. Depending on the organizational structure and/or the degree of maturity of the implementation, however, there may still be a need for action in this area, which should be planned for at an early stage.

Principle 5 – Management of risks from the cross-border services business

These requirements correspond to the previous Principle 7 and do not contain any significant changes.

Principle 6 – Business Continuity Management (BCM)

This principle formulates the requirements for the Business Impact Analysis (BIA) and the Business Continuity Plans (BCP). It also contains the requirements for the crisis team, periodic tests and regular reporting to the management. This largely implements the SBA’s previous recommendations in coordination with the BCBS and therefore does not contain any significant changes for institutions that already follow these standards.

Principle 7 – Operational resilience

This principle is new and essentially defines the coordination between the relevant components of risk management such as the management of operational risks, ICT/cyber risks, business continuity management, the management of outsourcing (see FINMA RS 2018/3 “Outsourcing”) and emergency planning. The principle formulates the specific requirements for the identification of critical, system-relevant processes, notification and adjustment in the event of significant changes, as well as regular testing and reporting. In the revised circular, FINMA addresses both business continuity management and operational resilience requirements. At first glance, these seem to overlap, but they differ in their objectives.

Operational resilience

Convergence of the protection goals of BCM and operational resilience

While BCM covers all critical processes in connection with the institution’s business performance, operational resilience focuses on the systemically relevant functions. This means that the requirements for operational resilience depend heavily on the respective systemic relevance of the institution. The transition period for achieving operational resilience should be 3 years, with critical functions being identified after just one year.

Principle 8 – Continuation of critical services in the resolution and restructuring of systemically important banks

These requirements correspond to the previous Principle 6 and do not contain any significant changes.

The implementation effort depends heavily on the degree of maturity of existing practice

FINMA points out that the principles of the revised Circular apply in principle to all addressees, but must still be implemented in individual cases according to size, complexity and structure, as well as the respective risk profile. Irrespective of this, institutions that have already implemented best practice standards in risk and business continuity management are likely to have a more manageable effort to implement these guidelines.

Pragmatica helps with the planning and implementation of the new FINMA guidelines

Do you need support in implementing the new regulations? Our teams of experts in the areas of risk and continuity management, as well as information and cyber security, take the pressure off your valuable resources and help you to analyze your institution’s need for action and implement it in a targeted and efficient manner.

Further topics

,

Digital Onboarding in Banking

to the article ➞

,

Process Mining and AI: Webinars I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

Der Beitrag Revision FINMA RS Operational Risks Banks: The most important changes erschien zuerst auf Pragmatica AG.

]]> Cyber resilience for the European financial market https://www.pragmatica.ch/en/cyber-resilience-for-the-european-financial-market/ Mon, 10 Jan 2022 02:00:00 +0000 https://www.pragmatica.ch/cyber-resilienz-fuer-den-europaeischen-finanzmarkt/ Cyber resilience for the European financial market DIGITAL FINANCE PACKAGE Competitiveness and innovation for the EU financial sector The Digital Operational Resilience Act, or DORA for short, provides for the introduction of a comprehensive legal framework at EU level. The current draft of the planned EU regulation “on the operational resilience of digital systems in […]

Der Beitrag Cyber resilience for the European financial market erschien zuerst auf Pragmatica AG.

]]>

Cyber resilience for the European financial market

  • DIGITAL FINANCE PACKAGE

Competitiveness and innovation for the EU financial sector

The Digital Operational Resilience Act, or DORA for short, provides for the introduction of a comprehensive legal framework at EU level. The current draft of the planned EU regulation “on the operational resilience of digital systems in the financial sector” contains requirements relating to ICT risk management, the classification and reporting of ICT incidents, resilience tests for ICT-related incidents, contractual agreements between third-party service providers and financial companies, regulation of critical IT service providers under direct EU supervision and rules for the corresponding exchange of information.

The proposed Digital Operational Resilience Act (DORA) is part of the package of measures for the digitalization of the financial sector (Digital Finance Package), which the European Commission presented in September 2020. With this package, the Commission wants to promote the competitiveness and innovation of the EU financial sector. The DORA draft was provisionally approved by the Commission in July 2022 and is due to be adopted by the European Parliament this November.

The aim of the legislation is to harmonize existing EU and member state requirements as well as European Central Bank (ECB) guidelines.

From banks to insurance brokers - DORA affects all market participants in the EU

DORA applies to all financial companies regulated at EU level. The draft mentions trading venues, credit, payment and crypto institutions, investment and management companies, pension funds, insurers and reinsurers, as well as rating agencies and audit firms by name. However, the EU Commission explicitly points out that the requirements of DORA should be implemented in accordance with the principle of proportionality, i.e. taking into account systemic relevance, business model and risk profile. This means that smaller financial companies, for example, will have to take less extensive measures to report incidents and carry out resilience tests.

Risk management - mandatory reporting and resilience tests. The focal points of DORA

IT Risk Management

Companies must identify, classify and document IT risks that pose a threat to business processes. This also applies in particular to system areas that are networked with internal and external IT systems. In addition, all necessary guidelines, procedures and technologies must be implemented to ensure continuous monitoring and control of IT systems and to detect anomalous activities and potential vulnerabilities.

Companies are obliged to carry out a business impact analysis (BIA) and draw up appropriate emergency planning to maintain and restore business operations, namely for the areas of incident response, business continuity and disaster recovery.

Reporting on IT incidents

Financial companies must set up and apply a specific incident management process to identify, track, log, categorize and classify IT incidents. The classification of ICT incidents must be based on a set of criteria to be further developed by the Joint Committee of the ESAs. Companies are obliged to report serious IT incidents to the competent authority within prescribed deadlines.

Implementation of resilience tests

DORA requires companies to implement a robust and comprehensive digital business resilience program that encompasses the organization, processes and IT systems. The specified periodicity and the exact scope are currently still being agreed by the committees. Annual tests or tests every three years and possibly “advanced tests” for certain market participants are under discussion.

Management of third-party risks

Financial companies must manage the risk from third-party IT providers in accordance with the risks defined in risk management. This relates in particular to responsibilities and liability, but also to a risk analysis before, as well as a periodic review of the risks during the performance period and a corresponding exit strategy.

Exchange of information on cyber threats

DORA is intended to create a framework in which financial companies can exchange information and knowledge about cyber threats with the aim of strengthening digital resilience. This includes, in particular, vulnerability and threat indicators, as well as Technics, Tactics & Procedures (TTPs)

Conclusion

DORA will affect practically all European financial market participants DORA is expected to come into force in the member states from 2023. While the thrust of DORA is clear, many important details are still being negotiated by EU legislators. What is foreseeable is that the requirements will be within the framework of already established standards. This means that companies that have already implemented the relevant standards in the areas of cyber risk management, cyber resilience and business continuity are likely to have fewer problems with DORA. However, we recommend that market participants, as well as service providers for corresponding market participants, identify the potential impact of DORA in a timely manner and plan accordingly.

How can Pragmatica provide support?

Thanks to our experts with many years of experience in the implementation of governance, risk and compliance requirements, we are able to support your organization in important activities and relieve your organization:

  1. DORA impact analyses
  2. Implementation of measures and governance frameworks
  3. Digital operational resilience testing
  4. Support in meeting regional requirements
  5. Support for cloud transformations for financial service providers

Further topics

,

Digital Onboarding in Banking

to the article ➞

,

Process Mining and AI: Webinars I & II

to the article ➞

Self-services in digital banking

to the article ➞

, ,

FINMA Risk Monitor 2025

to the article ➞

, ,

Generative AI

to the article ➞

, ,

From cost pressure to the efficiency revolution

to the article ➞

,

Do I really need AI?

to the article ➞

,

Switzerland in the crosshairs of foreign intelligence services

to the article ➞

, ,

Resilience in our supply chains: How the shifting threatscape demands comprehensive security risk management

to the article ➞

,

UBS Data Leak via Chain IQ: Third Party Risk & Supply Chain Security Lessons

to the article ➞

Der Beitrag Cyber resilience for the European financial market erschien zuerst auf Pragmatica AG.

]]>