Efficient IT outsourcing and data protection in Switzerland

What is ICT outsourcing?

ICT outsourcing refers to the partial or complete outsourcing of IT-supported business processes and IT infrastructures to external service providers. Companies benefit from specialised services such as cloud solutions, IT support, cyber security, data management and infrastructure operation in order to focus more on their core business and reduce costs and risks.

Advantages of ICT outsourcing

• • Access to state-of-the-art technology and expert knowledge
  • Increased flexibility and scalability of IT services
  • Cost savings through needs-based utilisation of external resources
  • Improved IT security and compliance thanks to specialised providers
  • Focus on the core business and increased competitiveness

Data protection in ICT outsourcing

The outsourcing of IT services is closely linked to data protection law. As soon as external service providers are given access to personal data, they are considered processors. As the controller, the company remains responsible for compliance with the Federal Act on Data Protection (FADP) and the GDPR. Many entrepreneurs therefore ask themselves: ‘What actually happens to my data when I use an external service provider?’ This concern is justified, as outsourcing not only means handing over technical tasks, but also part of your responsibility for protecting customer data and business secrets. The DPA and GDPR set out clear requirements here: As a company, you remain responsible for ensuring that your data is handled securely and correctly – even if an external IT partner is involved.

In concrete terms, this means that you need to ensure that your IT service provider knows exactly what it can and cannot do with the data. This requires a clear contract that regulates how the data is handled, how it is protected and who is liable if the worst comes to the worst. You also need to make sure that the service provider does not use any subcontractors without your knowledge and that all legal requirements are met if data is transferred abroad – for example to the USA. In short: you are handing over the data, but not the responsibility.

Typical pitfalls and recommendations

Many companies make similar mistakes when outsourcing ICT – often out of ignorance or because they rely too much on the promises made by providers. A common misconception is that outsourcing is automatic or that the solution is generic. Therefore, no contract would be required or the pre-formulated agreement for order processing or the Data Privacy Agreement or Addendum (DPA for short) is sufficient. However, such contracts and their service level agreement (SLA for short) are often too general or lack important points. For example, it is not clearly regulated by when the service provider must rectify an error, how data breaches are handled or how high the liability is in the event of damage. This can lead to unpleasant surprises later on.

Our recommendation: Get expert support when drawing up the contracts and go through the most important points point by point. Clarify how your data is protected, how you can react in the event of an emergency and how you can ensure that the service provider actually keeps its promises. And remember: trust is good, control is better – regularly check whether the agreed standards are actually being adhered to.

Best Practices for companies

Whether operating cloud infrastructures (e.g. Microsoft 365, AWS, Google Cloud), outsourced IT support (helpdesk), managed security services (incl. SOC), application hosting by third parties or external data processing as part of CRM or ERP systems – there are important principles to consider when outsourcing:

• • Careful selection and regular review of service providers

• • Detailed and up-to-date DPAs/DPAs with clear regulations on data protection, data security and liability
  • Ongoing training and sensitisation of employees
  • Involvement of data protection and legal experts in contract design and risk assessment

Conclusion

ICT outsourcing offers Swiss companies numerous opportunities to increase efficiency and modernise their IT. At the same time, data protection and compliance requirements are increasing. Legally compliant contracts and processes are essential in order to minimise risks and strengthen the trust of customers and business partners.

Frequently asked questions about ICT Outsourcing