Key Concept 6 — Consequences of Non-Compliance

Fines are only one of the risks — trust is often the bigger loss.

Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.

Typical consequences

  • Fines by the data protection authority, often based on turnover or on a fixed unit
  • Orders from authorities: stop a processing activity, delete data, change a system — which can halt a business process overnight
  • Claims for damages by the affected people, in some countries also through class actions or consumer associations
  • Loss of trust of customers, employees and business partners, and negative press
  • Business impact: lost tenders, failed due diligence and stricter requirements from customers
  • Personal liability of managers and employees under some laws

Sanctions in your jurisdiction

Switzerland

Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC / EDÖB)

  • Criminal fines of up to CHF 250,000, imposed on the responsible individuals, not on the company
  • Investigations and binding orders by the FDPIC
  • Civil claims and reputational damage
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Switzerland Slide 8 of 10