FAQ: AI and data protection for Swiss SMEs

No. The Swiss Federal Act on Data Protection also applies when AI processes personal data. For an initial writing exercise, use invented details in an approved tool. A real customer email or personnel file needs approval covering those specific data and that task.

Use the account your company has approved for work content. A personal login or a company email address alone says nothing about the contract and settings. Before pasting a customer email, check that you are in the correct company workspace. If approval is missing, ask internally and use invented details for now.

No. A plan name does not establish compliance with Swiss data protection law. Have the purpose, contractual terms, permissions and deletion arrangements assessed for the specific service. For example, ask: “Is this plan approved for customer enquiries, including attachments?” Approval for text does not automatically cover every additional feature.

No. Training and storage are different processes. Check separately whether inputs are used for model training, how long chats or files are retained and who can access them. Record the answers for the plan you actually use; switching off training does not answer the retention question.

Location alone is not enough to assess this. Ask the provider where inputs are processed, backups are stored and support access takes place, and which other service providers are involved. Include possible transfers abroad in the assessment. “Swiss hosting” does not replace appropriate access permissions or assessment of the actual use.

Not automatically. In a construction report, an address, project date and unusual damage could still identify a person. Check attachments and confidential business information too. A completely invented case is simpler for a summarisation exercise; use real documents only within the approval obtained for them.

The AI may gain access to additional content. Before connecting, check the account, reachable folders and read or write permissions. A test using manuals should not inadvertently expose the personnel folder. Obtain separate approval for the connection, including its search index and stored answers.

One possible starting rule is: “We practise with invented cases in the approved company account. We only upload real customer documents once the responsible person has approved that task and those data.” Add the tool name and internal contact. This tells staff what they can do now and whom to ask about a new task.

Yes. Article 2 covers, for example, providers placing AI systems on the EU market, as well as providers and deployers outside the EU where the outputs are used in the EU. Record who provides the system and where its results are used, then have the applicable obligations assessed. A Swiss registered office alone does not put a business outside its scope.

Describe a specific task, such as “summarising customer enquiries”, and list the data categories, service, plan, account and active connections. Include who can see inputs and results, plus the provider’s information on training, retention and deletion. Explain the task using an invented sample rather than a real customer file.

Stop further transfers and promptly notify the responsible person internally. Record the service, account, time and data categories involved; do not circulate the content again. The responsible team assesses deletion, possible recipients and any notification duties. Deleting a chat alone does not confirm that all copies have been removed.

Name a responsible person within the business. The operational team describes the task; IT and, where needed, privacy or legal specialists assess their areas. Make the decision specific, for example: “Drafts based on approved product information, without customer data.” Also record who decides again when new data or connected services are introduced.