7 GDPR and Swiss DSG Mistakes That Cost SMEs the Most (And How to Avoid Them)
From missed breach deadlines to phantom subprocessor lists, most data-protection failures are avoidable. Here are the mistakes Swiss SMEs make most often and how to fix them.
Data protection compliance is not glamorous, so it tends to get done in a hurry, once, and then never looked at again. That approach worked when nobody was checking. It stopped working the moment the Swiss revFADP/DSG came into force alongside the EU GDPR, giving authorities on both sides of the border clearer teeth and Swiss companies handling EU personal data two overlapping rulebooks to satisfy at once.
Most compliance failures at small and mid-sized businesses are not the result of bad intentions. They are the result of predictable process gaps. Here are the ones we see most often, why they happen, and what they actually cost when they go wrong.
Mistake 1: Treating GDPR and DSG as the same thing
Many Swiss SMEs assume that if they comply with GDPR, they automatically comply with the Swiss DSG, or vice versa. They don't line up perfectly. Breach notification is the clearest example: GDPR gives you a hard 72-hour clock to the supervisory authority, while the Swiss DSG only requires notification "as soon as possible" — a different standard with different timing logic. If your register doesn't know which jurisdiction a given record falls under, you'll either over-report under the wrong deadline or under-report and miss the real one.
The fix is structural: every record needs a jurisdiction tag from the start, so the correct clock — 72 hours or "as soon as possible" — applies automatically without someone manually checking which law applies each time.
Mistake 2: No controller register, or one nobody maintains
A surprising number of businesses either never built a controller register and DPO record with EU representative details, or built one once for an audit and let it go stale. When a regulator or a client's procurement team asks for it, someone spends a day reconstructing it from memory.
This is a case where the record should build itself. An AI-driven interview that pre-fills the controller register and DPO singleton, including EU representative fields, turns a half-day task into a fifteen-minute one — and because it lives in the same workspace as the rest of the business, it doesn't quietly go out of date.
Mistake 3: An Art. 30 ROPA that exists as a Word document from 2021
The record of processing activities (Art. 30 ROPA) is meant to be a living map of what data you process, on what legal basis, for how long, and who receives it. In practice it's often a document created for one audit and never touched again, which means it stops reflecting reality within months.
Pre-filling the ROPA through an AI interview — capturing legal basis, retention, and recipients as you go — keeps it usable as an ongoing register rather than a one-time deliverable.
Mistake 4: Losing track of subprocessors
Under Art. 28, you're responsible for knowing who processes personal data on your behalf — your hosting provider, your email platform, your payroll partner. The common failure is a subprocessor list that was accurate at signing and has since drifted, because nobody re-reads every new Data Processing Agreement (DPA) that lands in an inbox.
Auto-discovery from your own environment, combined with AI extraction that turns an uploaded DPA PDF into structured fields, closes that gap without asking anyone to manually re-key contracts.
Mistake 5: Skipping the DPIA threshold check entirely
A Data Protection Impact Assessment (Art. 35 DPIA) is only mandatory above a risk threshold, but most SMEs never run the threshold assessment in the first place, so they don't know whether they've crossed it. That's the actual exposure: not failing a DPIA, but never checking if one was required.
A one-click AI risk analysis that runs the threshold assessment and drafts a full DPIA when needed removes the excuse of "we didn't have time to check."
Mistake 6: Missing the 30-day clock on data subject requests
Data subject access requests have a 30-day response window with a possible 60-day extension. Missed deadlines are rarely deliberate — they happen because the request arrived in a generic inbox and got buried. The cost is reputational as much as regulatory: a data subject who has to chase a company for their own data forms a lasting impression.
Tracking the clock automatically, offering a one-click extension, and generating exportable Art. 15 bundles turns a request that used to require cross-referencing three systems into a task that takes minutes.
Mistake 7: TOMs and training that exist on paper only
Technical and organisational measures (TOMs, Art. 32) and staff training are two areas where "we have a policy" and "our people actually know it" are very different things. A binder of TOMs that nobody customised for the actual business, or a training session run once at onboarding, satisfies the letter of a checklist without doing much for real risk.
A TOMs baseline generator that produces concrete, bullet-point measures across twelve categories — tailored to your tenant rather than generic — gives you a starting point that's actually specific to your business. Pairing that with training assignments that include email invitations, "I have read and understood" attestation tokens, and one-click reminders means you can prove engagement, not just intent.
What ties it together
None of these mistakes are exotic. They happen because data protection is treated as a side project instead of a running part of the business — and because the tools for managing it live separately from the tools for running it. Flitz keeps the GDPR and Swiss DSG compliance programme in the same workspace as your books, with a document library, a public auditor dossier with password gating and revocation, and a breach incident log that already knows which deadline applies.
One thing stays constant regardless of tooling: AI-drafted registers, DPIAs, and notifications are a starting point, not a final answer. Every page carries the same disclaimer — Flitz does not provide legal advice, and a DPO should review AI-generated drafts before they go anywhere. The value isn't skipping that review. It's giving your DPO a correct, current draft to review instead of a blank page.