Accounting and data protection: are you making these mistakes with your business data?
Data protection in accounting means that all the personal data you process as part of your bookkeeping must meet legal requirements. In Switzerland, the new Federal Act on Data Protection (FADP) has been in force since 2023. If you specifically target customers in the EU, you also have to comply with the European General Data Protection Regulation (GDPR). Cloud accounting software plays a central role here, because the data is stored on external servers.
What Does Data Protection Mean in Accounting?
Anyone who keeps accounts processes personal data every day: names and addresses of customers and suppliers, bank details, and payroll data. The Swiss Federal Data Protection Act (FADP) has applied since 1 September 2023 to all companies in Switzerland that process data about individuals, regardless of the company’s size or legal form.
Anyone using cloud accounting software outsources data storage to a third-party provider. The law therefore requires you to contractually govern the processing of data by the provider (via a data processing agreement); in practice, this is done in writing, and under the GDPR the written form is even mandatory. If the data processing creates a high risk for the persons concerned, a written data protection impact assessment may also be required. If a severe data breach occurs despite all precautions, you must report it to the competent supervisory authority.
Swiss FADP or European GDPR: Which Law Applies to Your Company?
Whether you must comply with the Swiss Federal Data Protection Act, European data protection rules, or both depends on who you do business with.
Feature | Swiss FADP | European GDPR |
|---|---|---|
Who is affected? | All companies based in Switzerland | Additionally, if you specifically offer goods or services to individuals in the EU or monitor their behaviour there |
Potential fines | Up to CHF 250’000 against responsible individuals | Up to 4% of worldwide annual turnover or EUR 20 million against the company, whichever is higher |
Compliance effort | Less extensive documentation obligations | More documentation and accountability obligations |
Data storage abroad | Federal Council determines the list of safe countries | EU Commission determines safe countries |
For storing data in countries without an adequate level of data protection, both regulatory frameworks require specific contractual safeguards with the provider. Any Swiss company actively serving customers in the EU must comply with both frameworks simultaneously. This is crucial when choosing software and drafting contracts with providers.
Why Data Storage in Switzerland Is an Advantage
Whether your accounting data is stored on a Swiss server or abroad has concrete legal consequences.
When your data is stored in Switzerland, you benefit from several advantages:
No cross-border data transfer for storage: Anyone transferring data abroad must ensure that the destination country provides an adequate level of data protection or that specific contractual safeguards are in place with the provider. With a Swiss server location, this overhead is eliminated for the stored data.
Simpler compliance: The Swiss Federal Data Protection Act applies directly and without detours. No additional requirements from a foreign legal framework apply to the storage location itself. Whether the GDPR also applies depends on whether you specifically target individuals in the EU, not on the server location.
Clear jurisdiction: The Federal Data Protection and Information Commissioner (FDPIC) is responsible for compliance with the Swiss FADP. If the GDPR also applies to your company because you actively serve customers in the EU, EU data protection authorities may also have jurisdiction, regardless of where your data is stored.
Swiss data protection standards: Data stored in Switzerland is subject to Swiss data protection law, which is recognized internationally as strict and dependable.
Technically, an EU server location is also possible, provided the country in question is recognized as safe by Switzerland. The critical point is that you know where your data is stored and that this is clearly documented in the provider's privacy policy.
Which Accounting Data Is Particularly Sensitive?
Not all data in accounting is equally sensitive, but payroll records, bank details, and tax information belong to the most sensitive categories.
Payroll data incl. AHV/AVS numbers: Payroll documents require special care. The AHV/AVS number is a unique personal identification number and may only be used for statutory purposes.
Bank details of customers and suppliers: Account numbers enable direct payments and must be particularly well protected against unauthorized access.
Tax-relevant revenue data: This data is transmitted to the tax authorities. Both the accuracy of the data and its protection during transmission must be guaranteed.
Dunning and debt collection data: The payment behaviour of customers is personal data that reveals insights into their financial situation and must therefore be handled confidentially.
The Swiss Data Protection Act distinguishes between ordinary personal data and sensitive personal data. The latter includes health data, information on religious views or trade union activities, as well as data on administrative or criminal proceedings and sanctions; stricter rules apply to these. This is directly relevant to your accounting: Anyone processing payroll data related to illness is processing sensitive personal data. While debt collection data does not fall under this statutory category, its sensitivity warrants the same level of care.
Retention Obligations and Deletion Obligations: How Do They Work Together?
The Swiss Code of Obligations stipulates that accounting records and vouchers must be retained for ten years. At the same time, data protection law requires data to be deleted as soon as it is no longer needed. These two rules only appear contradictory: As long as the statutory retention period of ten years is running, this obligation takes precedence. The data must be kept because the law requires it. Once the ten years have elapsed, this justification ceases to apply, and the data must be deleted or anonymized so that it can no longer be linked to any individual.
The data protection authority can intervene in the event of breaches of deletion obligations. It is therefore advisable to define deletion periods in writing when implementing any software.
Key takeaway: The retention obligation protects you from premature deletion. After the period expires, data protection law protects the individuals concerned from unnecessarily long data storage. Good accounting software reflects this balance by automatically notifying you of the need for deletion or by anonymizing the data once the retention period has ended, without requiring manual intervention.
Technical Safeguards for Accounting Data
Data protection is not only a legal task, but also a technical one. The Data Protection Act explicitly obliges companies to implement appropriate technical measures. The following five measures represent the minimum standard for any cloud accounting solution.
Encrypted Data Transmission
Measure: Encrypted connection between your browser and the provider's server.
Purpose: Prevents data from being intercepted during transmission.
What to look for: The address bar of your browser should show "https" and a padlock icon.
Two-Factor Authentication
Measure: In addition to the password, a second verification step is required when logging in (e.g. a code via SMS or an app).
Purpose: Protects access even if someone knows your password.
What to look for: This option should be mandatory for all users, not merely optional.
Role-Based Access Controls
Measure: Different users are only granted access to the data they genuinely need for their work.
Purpose: Prevents, for example, someone in sales from accessing employees' payroll records.
What to look for: Check whether access permissions can be configured flexibly and in detail.
Automatic Data Backups
Measure: The provider regularly and automatically creates backup copies of all data.
Purpose: Prevents data loss in case of technical issues or cyberattacks.
What to look for: Ask how frequently backups are created, how long they are retained, and how quickly data can be restored in an emergency. The AI-powered document management by nextesy automates voucher archiving so that backups remain seamless.
Encrypted Data Storage
Measure: The stored data on the server is encrypted.
Purpose: Protects your data even if unauthorized access to the server occurs.
What to look for: Ask about the encryption standard used. A good benchmark is AES-256, which is considered exceptionally secure.
What to Look for in Privacy-Compliant Accounting Software
Anyone selecting accounting software should ask five concrete questions before signing the contract. These questions address the most common practical issues: lack of contractual basis, unclear data storage locations, and undefined deletion procedures.
Where is my data stored? (In Switzerland, in the EU, or elsewhere?)
Is there a written agreement with the provider governing how my data is processed and protected?
Which encryption method is used?
How is data deleted once the statutory retention period has expired?
Are third-party service providers involved, e.g. for payments, and do they also comply with data protection regulations?
nextesy was developed from the ground up for the Swiss market and relies on data storage in certified data centres in Switzerland. This simplifies compliance with the Swiss FADP. The involvement of third-party service providers is governed contractually; details can be found in the nextesy privacy policy. VAT accounting and payroll are integrated directly into the system, not retrofitted. Thanks to AI, nextesy handles most accounting tasks automatically, leaving you to deal only with exceptions. The starting price is currently CHF 29 per month for SMEs (special promotional price) and CHF 15 per month for fiduciaries, with a 14-day free trial (as of August 2026).
Frequently Asked Questions About Data Protection in Accounting
What is the difference between the Swiss Data Protection Act and European data protection regulations?
The Swiss Federal Data Protection Act (FADP) has applied since 1 September 2023 to all companies based in Switzerland. The European General Data Protection Regulation (GDPR) applies additionally if a Swiss company specifically offers goods or services to individuals in the EU or monitors their behaviour there. European rules are generally stricter: Non-compliance risks fines of up to 4% of worldwide annual turnover or EUR 20 million against the company. Swiss law imposes fines of up to CHF 250’000 against responsible individuals. Swiss SMEs with active EU business are therefore frequently subject to both legal frameworks simultaneously.
What must I consider under the Swiss Data Protection Act?
Among other obligations, the law requires you to use personal data exclusively for its intended purpose, implement appropriate technical safeguards, and report severe data breaches to the competent authority. When using cloud accounting software, you also need a data processing agreement with the provider, as you are outsourcing data processing to a third party. In the event of violations, fines of up to CHF 250’000 may be imposed.
What are the core principles of the Swiss Data Protection Act?
The law mandates that data must be processed lawfully and transparently, used only for the specified purpose, limited to what is necessary, and well protected technically. Purpose limitation specifically means: payroll data collected for payroll accounting must not simply be repurposed for other activities. Data minimization means you should only collect as much personal data as is genuinely required for accounting purposes.
What should I consider regarding data protection when choosing accounting software?
You should verify whether the provider offers a written agreement governing the handling of your data, where the data is stored, which encryption is utilized, and how data is deleted once the statutory retention period expires. For Swiss companies, a server location in Switzerland or in a recognized safe country is recommended, as no additional safeguards for foreign data transfer of the stored data are then required. Have all relevant documents provided in writing before signing the contract.
How important is data storage in Switzerland?
A Swiss server location significantly simplifies compliance with data protection legislation: the stored data does not leave the country, and no additional safeguards are required for cross-border storage transfer. The FDPIC has jurisdiction over the Swiss FADP; if the GDPR also applies, EU authorities may also have jurisdiction. Technically, an EU server location is also feasible, provided the country is recognized as safe. The decisive factor is that you know where your data is stored and that this is clearly documented in the provider's privacy policy.
Which accounting software stores all data in Switzerland?
nextesy is a Swiss accounting platform that stores all data in certified data centres in Switzerland. Processing complies with the Swiss FADP and is also GDPR-compliant. Once set up, the accounting runs largely autonomously thanks to AI. All details regarding how your data is handled can be found in the nextesy privacy policy.
