Required under both the GDPR and the Swiss FADP. We draft it from your actual data processing, not a generic template.
Most websites publish a document downloaded online or their CMS’s default template. These texts describe processing that does not exist, and stay silent on what actually does: contact forms, security tools, analytics, transfers outside the EU.
A document that does not match your actual processing does not fulfil your duty to inform. It mainly signals, to anyone who knows what to look for, that compliance has not been addressed.
Articles 13 and 14 of the GDPR. Informing data subjects is required from the first collection of personal data.
A breach exposes the company to a sanction from the competent supervisory authority.
Articles 19 and 20 of the FADP. The duty to inform applies to every company, with no exception based on size.
The FADP provides for fines of up to CHF 250,000 against the individual in charge, not the company.
Thirty minutes, no commitment, to identify what is missing from your compliance.