Apple devices under the revFADP and GDPR: duties, measures, evidence

Which rules apply to you

Switzerland’s revised Federal Act on Data Protection (revFADP, also called nFADP) has applied since 1 September 2023. The Data Protection Ordinance (DPO) specifies the data security requirements.

In the EU, the General Data Protection Regulation (GDPR) applies. It also covers Swiss companies that offer goods or services to people in the EU or monitor their behaviour (Art. 3(2) GDPR). Many companies in Basel, Zurich or with German subsidiaries therefore work with both frameworks.

Choosing measures by risk

Both laws require measures appropriate to the risk. For laptops and phones, these basics have proven themselves, and an MDM enforces them consistently on every device:

• Encryption: FileVault on every Mac; on iPhone and iPad, data protection is active once a passcode is set. Recovery keys are stored in the MDM, not with the user.
• Updates: operating system and apps are updated promptly, with deadlines instead of optional reminders.
• Screen lock and sign-in: mandatory passcode, auto-lock and strong sign-in, ideally with two-factor via your identity provider.
• Access rights: no everyday admin rights; company data only in managed apps and accounts.
• Remote wipe: lost devices can be locked and erased.
• Separated data on personal devices: for BYOD, account-driven enrollment keeps work and personal data apart.

Keeping usable evidence

When something happens, having measures is not enough. You must be able to show they were effective at the time of the incident. An MDM provides the evidence:

• device list with serial number, user and assignment
• encryption status and time of the last check per device
• operating system version and patch level
• log of lock and wipe commands
• documented policies and their changes

A plan for lost devices

1. Employees report the loss immediately to a clear contact, including at weekends.
2. IT puts the device into Lost Mode or erases it remotely.
3. You check in the MDM whether it was encrypted, when it was last online and what data was on it.
4. You assess the risk and document the decision, even if you do not notify.
5. If a high risk is likely, notify the FDPIC in Switzerland or the competent supervisory authority in the EU.
6. The person’s credentials and sessions are reset.

An encrypted, locked Mac is usually a much lower risk than an unencrypted one. The assessment is still a case-by-case decision and should be documented.

Vendors and data location

MDM vendors process device and user data on your behalf. Sign a data processing agreement and clarify where data is stored. For transfers to the US, Swiss companies can rely on the Swiss-U.S. Data Privacy Framework since 15 September 2024 if the recipient is certified. The EU has confirmed that Switzerland provides an adequate level of protection, so transfers from the EU to Switzerland need no additional contracts.