Switzerland intends to fundamentally overhaul its cyber regulation. A standalone cyber security law is set to cover manufacturers of digital products as well as operators of critical infrastructure, hosting providers and cloud service providers. For businesses, this is not just a matter of new IT security requirements: product development, management, legal and compliance functions are also likely to be affected. This may provide greater clarity – but at the same time risks creating new overlaps. The key factor will be whether the legislator succeeds in reconciling European standards, effective cyber security and workable compliance.

AI training data, the Digital Omnibus, the protection of children’s biometric data and freedom of assembly are the focus of episode 191.

Every Thursday, 10 am–11 am. Register now for free! If you have any questions or suggestions, please feel free to send a message to friedrich@haerting.de. Are you also looking for external webinars and events? You can find these under ‘Events’.

Cameras, radar sensors and AI can detect falls and alert care staff. However, when technical assistance is used in bedrooms, patient rooms or other private areas, the stakes are particularly high. The EDÖB and privatim set out the limits imposed by data protection law in a new guide. For hospitals and care homes, this means above all that surveillance must not become standard practice – and data protection must be taken into account right from the stage of procuring the technology.

Smartwatches have long been part of everyday life in the office. Smart glasses now represent a new generation of wearables that carry cameras, microphones and AI functions directly on the body. This creates new risks for organisations: confidential conversations can be recorded, people can be filmed without their knowledge, and data can be transferred to external clouds. The FDPIC warns of the data protection risks posed by wearables. Organisations should therefore check whether their existing data protection and IT policies are still adequate.

The EU is significantly expanding the information requirements regarding warranty rights and guarantees in the retail sector. From 27 September 2026, online and high-street retailers must use standardised model notices (‘harmonised notice’ and – under strict conditions – a guarantee label).

Swiss companies want to finally move artificial intelligence (AI) beyond the pilot phase. Yet, when it comes to scaling up, of all things, data protection, cloud contracts, copyright, employee data and the EU AI Act quickly become stumbling blocks. The good news is that companies do not have to wait for the announced amendments to Swiss legislation. Those who translate the existing rules into a functioning AI governance framework today can combine innovation with legal certainty.

At the 45th RDV Forum, Dr Martin Schirmbacher and Dr Hubertus von Roenne will discuss how the AI Regulation and the Data Act are changing the role of data protection officers. The forum marks the start of the 50th DAFTA in 2026.

The new EU Packaging Regulation (PPWR) will, in principle, come into force on 12 August 2026 – and its scope extends beyond the Swiss border. Anyone supplying packaged products from Switzerland to the EU or selling directly to EU customers must comply with new requirements regarding packaging design, recyclability, documentation and producer responsibility. Online retailers, in particular, face additional obligations. Anyone who only begins to review their packaging and bring it into line with the new requirements in 2030 is therefore likely to be too late.

At the BvD Autumn Conference 2026, Dr Martin Schirmbacher will speak about the data access rights set out in the Data Act, potential conflicts with the GDPR, and the implications for data protection consultancy.

Newsletters, text message discounts and event invitations are indispensable marketing tools for many businesses. However, any business that continues to send marketing messages to customers despite them having unsubscribed, or ignores requests to have their data deleted, risks more than just upsetting recipients. A new EDÖB ruling makes it clear: Opt-out means opt-out — and data protection in marketing must be technically effective. The ruling also makes it clear that it is not merely a question of whether companies correctly formulate their marketing policies on paper. Objections and requests for deletion must actually be implemented across all systems and communication channels.