Skip to content

IT Security

Without adequate information security, digitisation is not possible. We offer advice on the legal aspects of IT and data security.

How we can help
  • IT Security

    We inform our clients which legal IT security obligations must be observed. The same applies to critical infrastructure operators (KRITIS).

  • Data security

    There can be no privacy without data security. We advise on the legal requirements of the GDPR and other data protection regulations for the introduction and documentation of technical and organisational measures.

  • Obligation to report

    We perform legal assessments of security incidents and check the existence of reporting obligations to authorities and affected persons. If necessary, we will prepare a report that safeguards your interests.

  • Liability risks

    We identify personal and company-related liability risks as well as compliance obligations with regard to IT security for the Executive Board and management.

  • Drafting of contracts

    In addition to drafting contractual clauses to ensure the confidentiality of information vis-à-vis business partners, we also formulate staff agreements. These include, for example, the appointment of IT security and data protection officers as well as the obligation to maintain employee data secrecy.

  • IT security concept

    We provide legal support for the introduction of IT security concepts. This includes, for example, the establishment of risk management or internal IT security guidelines, and also the implementation of a data protection impact assessment or legal support for certification procedures and security audits.

References
IT security guidelines

We are advising a producer and supplier of products for the entertainment and event industry on the design of group-wide IT security guidelines for employees dealing with corporate IT.

Security solutions for the home office

We advise companies on the design of home office solutions while maintaining IT and data security requirements.

Previous slide
/
Next slide
Team
Newest Insights
Cybercrime at record levels – need for action for companies

1. April 2025
by Dominic Grunder & Nicole Beranek Zanon

General crime in Switzerland has risen again - but particularly dramatically in the digital space. Cybercrime has more than doubled in just a few years and is becoming a key challenge for private individuals and companies. In view of this dynamic, preventive measures are essential. The following article analyses the current figures and shows how companies can protect themselves effectively.

No joke: mandatory reporting of cyber attacks on critical infrastructures applies from 1 April 2025

11. March 2025
by Nicole Beranek Zanon

In a presentation at the University of Bern on 22 August 2023, I explained the modalities regarding data security and reporting obligations under the DPA and the ISG in procurement. Now there is something to report again in this area: From 1 April 2025, operators of critical infrastructure in Switzerland will be obliged to report cyberattacks suffered to the Federal Office for Cybersecurity (BACS) within 24 hours of their discovery. This measure is intended to strengthen cyber security and increase the resilience of essential services. We showed that this is necessary in the Insight of 31 December 2024, in which we reported on the high number of cyber incidents in Switzerland (every 8.5 minutes!). The current article explains the background to the new reporting obligation, the legal basis, the sectors affected and the practical implications, and provides recommendations for action for companies and authorities.

Cyberattacks in Switzerland: every 8.5 minutes!

31. December 2024

According to the Federal Office for Cyber Security, a cyber incident is reported on average every 8.5 minutes in Switzerland. The number of reported cyber incidents in Switzerland rose sharply in 2024 - almost twice as many reports were received by the Federal Office for Cybersecurity (FOCS) as in the previous year. Private individuals and companies are particularly frequently affected by attempted fraud and phishing attacks. New fraud methods such as deepfakes or fake calls in the name of authorities are also on the rise.

Here comes DORA: New requirements for digital resilience in the financial sector (Part 1)

8. November 2023
by Nicole Beranek Zanon & Linus Haak

On 14 December 2022, the European legislator adopted a legislative package on digital operational resilience in the financial sector. Financial companies operating in the European Single Market are now subject to specific obligations to secure their digital systems. However, service providers of such digital systems are also affected. The requirements must be complied with from 17 January 2025.

Insights about IT Security
More about us
Expertise
IT Projects

When we think of the word "sprint" we don't just think of athletics, but also of SCRUM. Be it agile project methods or a classic approach based on the waterfall principle: we accompany IT projects from the beginning to the end and even beyond if necessary. We are familiar with both sides.

Learn more
Expertise
IT Law

The Law of Information Technology in all its facets is an exciting cross-sectional subject matter that has been familiar to us since its inception. IT law characterises our daily work and engages our lawyers and teams across several law firms with a variety of focal points. Specific expertise is simultaneously concentrated on individual core competences. In doing so, we not only know the law, but also have an understanding of technology.

Learn more