Suspect a breach? Report it immediately — response within 1 hour.Report an incident
Application of Switzerland's dedicated framework — the revised Federal Act on Data Protection (nFADP) and the Cybersecurity Ordinance — overseen by the NCSC.
Last updated — August 22, 2026
EBH Security applies Switzerland's regulatory framework, built around the National Cyber Security Centre (NCSC), the federal reference authority for cybersecurity, and the revised Federal Act on Data Protection (nFADP), in force since 2023, which governs the collection and processing of personal data under principles of transparency, data minimization and security by design. The Cybersecurity Ordinance complements this framework by setting out incident notification and risk management obligations applicable to critical infrastructure and organizations under NCSC oversight. This Swiss-specific regulatory architecture forms the structuring reference for any engagement carried out in this market.
Engagement model
Direct engagement
Applied framework
nFADP and Cybersecurity Ordinance, under NCSC oversight
Languages
French, German, English
The revised Federal Act on Data Protection (nFADP) and the Cybersecurity Ordinance, two Swiss-specific instruments, under the coordination of the National Cyber Security Centre (NCSC).
The revised Federal Act on Data Protection, in force since 2023, which governs the collection and processing of personal data under principles of transparency, data minimization and security by design.
The National Cyber Security Centre is Switzerland's federal reference authority for cybersecurity; it issues recommendations and oversees the incident notification framework.
An instrument setting out incident notification and risk management obligations applicable in particular to Swiss critical infrastructure.
Security audits and GRC compliance aligned with the nFADP, complemented by cloud security and continuous monitoring for organizations subject to the NCSC's notification framework.
With an initial scoping phase to identify the data processing activities covered by the nFADP and, where applicable, the notification obligations under the Cybersecurity Ordinance.
