Data protection requirements are constantly evolving. This commentary on the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) offers practical and well-founded guidance on how to deal with the complex requirements of data protection law. The 4th edition (2026) takes account of the latest legislative developments, particularly in relation to digital services, artificial intelligence and the European Health Data Space. The latest case law, particularly that of the Court of Justice of the European Union (CJEU), as well as recent statements from data protection supervisory authorities, have also been incorporated into the commentary. The commentary combines academic rigour with practical solutions, thereby offering valuable guidance on the legally compliant processing of personal data in businesses, public authorities and legal practice. The contributors also include Sebastian Schulz and Erik Petersen of HÄRTING, who, in the 4th edition, have for the first time taken on the commentary on Article 9 of the GDPR concerning the processing of special categories of personal data.

Endless scrolling, personalised adverts, contact requests from strangers: protecting young people on social media involves more than just problematic content. The Federal Council intends to amend the proposed Swiss Platform Act (KomPG) to include obligations to protect minors. The focus is on the risks posed by these services and a ban on targeted advertising. To what extent will platforms have to alter their services to comply? We set the record straight.

Swiss company law protects minority shareholders by granting them rights to information, inspection and subscription. But how far does this protection extend in court? In its judgements 4A_144/2026 of 29 June 2026 and 4A_115/2026 of 21 July 2026, the Federal Supreme Court dealt with cases involving the refusal to grant access to business documents and disputed capital increases. Both cases demonstrate that even those with substantial shareholdings may face legal and procedural obstacles when seeking to enforce their shareholder rights.

Checklists and overviews on the implementation of NIS 2.

An AI policy alone does not constitute governance. It is crucial that organisations know which AI systems are being used, who decides on their deployment, which risks are accepted, and how procurement, operation, monitoring and escalation are embedded within the organisation. The training course provides a practical governance model for organisations wishing to scale AI in a controlled manner.

Artificial intelligence is often put to productive use within organisations more quickly than legal, contractual and organisational safeguards can be put in place. This training course demonstrates how specific AI use cases can be structured, assessed on a risk-based basis, approved and monitored from the initial idea through to live operation – with a focus on Swiss law and relevant EU considerations.

Switzerland intends to fundamentally overhaul its cyber regulation. A standalone cyber security law is set to cover manufacturers of digital products as well as operators of critical infrastructure, hosting providers and cloud service providers. For businesses, this is not just a matter of new IT security requirements: product development, management, legal and compliance functions are also likely to be affected. This may provide greater clarity – but at the same time risks creating new overlaps. The key factor will be whether the legislator succeeds in reconciling European standards, effective cyber security and workable compliance.

AI training data, the Digital Omnibus, the protection of children’s biometric data and freedom of assembly are the focus of episode 191.

Anyone who consents to their data being used for advertising by ‘partners’ must, it seems, also know who these partners actually are. In Case C-317/25 – Groupe Canal +, Advocate General Dean Spielmann proposes a correspondingly strict approach to the ECJ: General consent granted to unspecified ‘partners’ should not, in principle, legitimise electronic direct marketing. For companies that obtain leads, customer data or marketing contacts from third parties, the ruling could have significant practical consequences.

Every Thursday, 10 am–11 am. Register now for free! If you have any questions or suggestions, please feel free to send a message to friedrich@haerting.de. Are you also looking for external webinars and events? You can find these under ‘Events’.

Cameras, radar sensors and AI can detect falls and alert care staff. However, when technical assistance is used in bedrooms, patient rooms or other private areas, there is a great deal at stake. The EDÖB and privatim set out the limits imposed by data protection law in a new guide. For hospitals and care homes, this means above all that surveillance must not become standard practice – and data protection must be taken into account right from the outset, when the technology is procured.