Know
Where your patient data is and how it is protected. On the server, in the cloud, on a USB stick, in your e-mail, on a member of staff's phone.
FADP compliance · Cybersecurity
Protect your patients' data. It is a legal obligation.
Since 1 September 2023, the new Federal Act on Data Protection (FADP) has held you personally responsible for the security of your patients' data. This guide explains your obligations and the practical measures to put in place.
THE SITUATION IN SWITZERLAND
Why your practice is concerned
Cyberattacks do not only target large companies. Mass attacks also reach medical and dental practices: a single click on a fake e-mail can be enough.
- 64,733Cyber incidents reported to the FOCS in 2025
- 2Attacks in one year on Groupe 3R, a radiology network in French-speaking Switzerland
- 5 weeksFor Vidymed to recover most of its data
- 250,000CHF maximum fine (FADP)
Sources: 2025 annual report of the Federal Office for Cyber Security (FOCS), press releases from Groupe 3R (April 2025 and April 2026) and Vidymed (December 2024 and January 2025).
Personal liability FADP fines target individuals, not the company, and only intentional violations, most often following a complaint. In a dental practice, it is generally the owner or the manager who is concerned. The limitation period is 5 years (Art. 66 FADP).
WHAT THE LAW REQUIRES
Your 3 fundamental obligations
The FADP does not ask you to become an IT specialist. It asks you to know, to react and to prove.
Notify
If a data security breach is likely to result in a high risk for patients, the FDPIC must be informed as soon as possible (Art. 24 FADP). The patients concerned must be informed if their protection requires it or if the FDPIC so requests.
Demonstrate
On request, you must be able to prove that you have taken the necessary technical and organisational measures: documentation, agreements, training, record of processing activities.
SENSITIVE DATA
Which data is protected in your practice?
A dental practice processes health data every day. This data is classified as sensitive within the meaning of Art. 5 let. c FADP and is subject to stricter rules. The practice's other personal data also requires careful protection.
Health data
X-rays, CBCT, intraoral photos, diagnoses, treatment plans, prescriptions, medical history (including medical history forms), clinical notes, correspondence with other practitioners.
Digital impressions and models
Digital dental impressions, optical impressions, 3D models: these are health data, and therefore sensitive (Art. 5 let. c no. 2). They would only be biometric data (no. 4) if they were used to identify a person uniquely.
Administrative data
AHV numbers, dates of birth, contact details, consents, basic (LAMal) and supplementary insurance data.
Correspondence and invoicing
E-mail exchanges with patients, laboratory orders, invoices, insurance statements, payment history.
PRACTICAL MEASURES
What you need to put in place
Each point below is covered in detail in the reference guide, which you can download free of charge at the bottom of the page.
Secure e-mail
Any communication containing patient data must go through end-to-end encrypted e-mail. Gmail, Hotmail, Bluewin and WhatsApp are not compliant for medical data.
Updates
All computers must run an operating system that is still supported by its vendor. Support for Windows 10 ended in October 2025. Dental software and web browsers must also be up to date.
3-2-1 backups
3 copies of your data, on 2 different media, 1 of them outside the practice, and ideally a disconnected or immutable copy. Restores must be tested regularly, at least once a year. Your IT provider must put this strategy in place and document it.
Drive encryption
BitLocker (Windows) and FileVault (macOS) must be enabled on all computers and servers. A stolen computer without encryption immediately exposes all patient data.
Passwords and two-factor authentication
At least 12 characters, stored in a secure password manager. Two-factor authentication (2FA) must be enabled on all critical access: e-mail, practice management software, remote access.
Separate WiFi network
The practice network (computers, server, printers) must be physically separated from the guest network for patients. An infected device on the guest network must not be able to reach your data.
Secure remote access
Free remote access tools left permanently on standby (TeamViewer, AnyDesk) are a major risk. A professional VPN or an RMM solution managed by your provider are the compliant alternatives.
EDR protection
An antivirus on its own, whose alerts no one follows, lets new attacks through. An EDR (Endpoint Detection and Response) solution, monitored by a professional, detects threats through behavioural analysis and makes it possible to respond to them.
User access management
A personal account for each member of staff, the principle of least privilege, immediate deactivation when someone leaves. No shared accounts.
Data processing agreement (Art. 9 FADP)
An agreement is mandatory with any provider that processes patient data on behalf of the practice: IT provider, cloud hosting provider, fiduciary. It is best put in writing, so that it can be proven. Without an agreement, your recourse if a problem arises is much harder to enforce, and intentionally entrusting data without complying with these rules is punishable, on complaint, by a fine of up to CHF 250,000.
Staff training
Human error is behind a significant share of data breaches. Staff training (phishing, passwords, emergency procedure, professional secrecy) must take place at least once a year.
Cyber insurance
Even with a good level of security, there is no such thing as zero risk. Cyber insurance covers the costs of emergency response, loss of revenue and notification costs in the event of an incident.
IF AN INCIDENT OCCURS
The 6 emergency steps
If you suspect an attack or a data leak, the first minutes are decisive. Follow these steps in order.
Isolate
Unplug the network cable, turn off the WiFi. Do not switch the computer off; that destroys the evidence.
Call your IT provider
Your IT provider first. If unavailable: the FOCS via incidents@ncsc.ch or report.ncsc.admin.ch.
Document
Photograph the screens, note the exact time, list the computers and data that may be affected.
Do not pay a ransom
The Confederation's official recommendation. Paying guarantees nothing and finances criminal networks.
Assess
Is patient data affected? If the risk for patients is likely to be high, or cannot be ruled out quickly, reporting to the FDPIC is mandatory; with ransomware, this risk is to be presumed depending on the circumstances.
Notify the FDPIC
Via databreach.edoeb.admin.ch, as soon as possible (Art. 24 FADP).
The FDPIC does not raid your practice. It reads your report, checks that you reacted correctly and may ask for further details. The golden rule: notifying early is better than not notifying.
REAL CASES
Attacks in French-speaking Switzerland, not just on television
| Incident | Date | Consequences |
|---|---|---|
| Groupe 3R, Réseau Radiologique Romand (20 centres, 7 cantons) | April 2025 and April 2026 | Two ransomware attacks, patient data stolen; ransom refused, data published in 2026 |
| Vidymed, Lausanne and Epalinges | December 2024 | IT systems suspended, back to paper; most of the data restored five weeks later |
What an attack costs Days, sometimes weeks, of working at reduced capacity: at Vidymed, it took five weeks to recover most of the data. Add to that the recovery work, informing patients and the loss of their trust.
EMERGENCY CONTACTS
Numbers and portals to keep
| Body | Role | Contact |
|---|---|---|
| FOCS | Reporting a cyberattack | incidents@ncsc.ch · report.ncsc.admin.ch |
| FDPIC | Notifying a data breach | +41 58 462 43 95 (Mon-Fri 10:00-12:00) · databreach.edoeb.admin.ch |
| Cantonal police | Theft of equipment, filing a complaint | 117 |
FREE RESOURCES
Documents to download
All the documents below are free and can be downloaded freely. They are designed to be used directly in your practice.
- DS1
- DS2
Quick-reaction sheet - Security incident
Emergency procedure. Double-sided, to print and display in the practice.
- DS3
- DS4
- DS5
Template - Incident procedure (staff)
The 6 steps and emergency contacts. To hand to every member of staff.
- DS6
Template - Rules for temporary staff
One-page document for trainees, locums and external contractors.
- DS7
Template - Data processing agreement (generic)
Agreement under Art. 9 FADP for any provider that processes patient data for the practice.
- DS8
Record of processing activities
A structured inventory of all the data processing in the practice.
- DS9
Patient data protection notice
Information for patients about how their personal data is processed.
- DS10
Template - Reply to an access request
Standard letter for replying to patients’ access requests (Art. 25 FADP).
- DS11
Free use These documents are provided for information and educational purposes. They do not constitute legal advice. Adapt them to the specific situation of your practice and consult a lawyer specialising in the field for any question relating to the FADP.
Need support with your compliance?
DentalSystems Sàrl supports dental practices in French-speaking Switzerland with cybersecurity, FADP compliance and IT infrastructure.
DentalSystems Quality, Security, Transparency
Quiz - FADP & Cybersecurity
Notes on the guide
Legal notice and terms of use
This document was written by DentalSystems Sàrl for information and awareness purposes. It does not constitute legal advice. The information in this document is up to date as of October 2026 and may change as legislation and regulations evolve.
For any legal question relating to the FADP, the GDPR or data protection in the medical context, consult a lawyer specialising in the field.
This English version is a translation; the French version prevails. Swiss laws are only legally binding in their official languages (French, German and Italian): the English names and quotations of Swiss law are given for information.
Intellectual property
This document is the exclusive property of DentalSystems Sàrl. All of its content (texts, structure, layout and graphic elements) is protected by copyright in accordance with the Federal Act on Copyright and Related Rights (CopA, SR 231.1).
Permitted use
The guide and the quick-reaction sheet may be freely downloaded, printed and distributed within a dental practice or a medical organisation, without modification and with mention of their author (DentalSystems Sàrl). The templates (DS3 to DS11) may be modified and used under the practice's name, including with its patients, staff and providers, without keeping our references.
Prohibited use
Unless DentalSystems Sàrl has given its prior written consent, it is forbidden to sell these documents, even modified, or to offer them for download to third parties (download sites, sharing platforms, resellers).
Limitation of liability
These documents are provided free of charge, for information. To the extent permitted by Swiss law, DentalSystems Sàrl is not liable for the consequences of their use; this limitation does not apply in the event of intent or gross negligence. Users remain responsible for adapting them to their situation. They replace neither a professional audit nor legal advice.
DentalSystems Sàrl
Thomas Alvino, IT Technician
www.dentalsystems.ch | talvino@dentalsystems.ch | +41 77 245 48 44
© 2026 DentalSystems Sàrl. All rights reserved.