Does the revFADP or the GDPR apply to our Swiss shop?
The revFADP always applies, and the GDPR is added as soon as you serve customers in the EU. The revised Swiss Federal Act on Data Protection has been in force since 1 September 2023 and is supervised by the FDPIC. Among other things it requires privacy by design, a duty to inform, a data protection impact assessment for high-risk processing and a right of access. If your shop ships to Germany or Austria, the GDPR applies in parallel with a data processing agreement and an impact assessment. An ACO system has to serve both: read-only access, an audit log per action and transparency about which data sits in which zone. Clarify the specifics of your shop with your data protection adviser.