Data governance and GDPR for La Chaux-de-Fonds organisations: controls that produce evidence

Nobody in La Chaux-de-Fonds has ever called us because they wanted governance. They call because an auditor, a regulator or a customer asked a question they could not answer.

This page covers data governance and compliance for analytics estates in La Chaux-de-Fonds: what the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) expects under the revised Federal Act on Data Protection (revFADP / revDSG), in force since September 2023, which sector rules bite hardest given the local economy of precision engineering and instruments, industrial machinery and engineering, and electronics and semiconductors, and how to implement controls in Microsoft Purview and Power BI that produce evidence rather than paperwork.

What the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) expects of an analytics estate

Under the revised Federal Act on Data Protection (revFADP / revDSG), in force since September 2023, four obligations land on an analytics estate harder than the rest: collect no more than you need, keep it no longer than you must, control who can reach it, and be able to answer an access or erasure request. Analytics estates fail these quietly: a warehouse accumulates every column from every source because it was easier than deciding, retention defaults to forever, and permissions are granted to individuals who then change role.

• The revFADP brought Swiss law closer to the GDPR but not identical to it: records of processing, impact assessments and breach notification follow Swiss rules, and an EU-shaped compliance pack needs adapting rather than copying.
• FINMA outsourcing expectations require documented control over cloud providers, including the right to audit and a tested exit plan.
• Article 321 of the Criminal Code and sectoral secrecy duties restrict who may see client-identifying data, which has direct consequences for row-level security design.
• Cross-border transfer of client data out of Switzerland is a board-level question in financial services, not an IT decision.

None of this requires a governance department. The working parts are a catalogue people search, classification that changes what happens to the data, access delegated through groups, and evidence on demand. None of that requires a governance function.

Sector rules that bite in La Chaux-de-Fonds

La Chaux-de-Fonds's economy means the governance conversation here is not generic. With one of the historic centres of Swiss watchmaking and micro-mechanical component manufacturing shaping the local client base, these are the obligations that come up in practice.

Precision engineering and instruments

Calibration and measurement traceability records are audited under quality standards, and retention periods are long. Low-volume, high-value production with extensive measurement data per part, long order books and a service business attached to the installed base.

The practical consequence for an analytics estate is that access design cannot be retrofitted. Row-level and object-level security have to reflect how authority is actually delegated in the organisation, and the design needs testing from a non-privileged account rather than assumed from documentation.

Industrial machinery and engineering

Export control and dual-use classification data should be modelled explicitly where machinery is shipped outside the EU and UK. Typical systems in scope: ERP, PLM / CAD, project management, field service management and CRM.

Medical devices

EU MDR post-market surveillance and vigilance reporting require a reproducible data trail from field event back to production batch.

Who can see what, and how you prove it

This is the question that exposes an estate, and the fix is unglamorous. An estate built on individual grants can only be evidenced by investigation. One built on directory groups aligned to your control model can be evidenced by running a report.

The sequence is always the same: extract the permissions that actually exist, design groups around how the organisation really delegates authority, migrate and remove the individual grants, then make the evidence self-service so your second line runs the report instead of raising a request. For a business in precision engineering and instruments, the groups normally need granularity by function and by entity or site.

Classification, labels and the export problem

Exports to spreadsheets are where most analytics estates leak, and it is rarely malicious: someone needed the numbers in a format they could work with. Sensitivity labels applied in Power BI travel with the exported file, so encryption and access restrictions persist outside the platform, and export can be blocked entirely for specific labels or audiences.

The classification scheme has to align to the information security policy you already have rather than introduce a competing taxonomy, and retention has to be enforced against your actual obligation under the revised Federal Act on Data Protection (revFADP / revDSG), in force since September 2023 instead of kept forever by default. Every control is then verified from a non-privileged account, because the most common finding in a governance review is a restriction that was configured correctly and never actually tried.

Working with Swiss organisations: the practical constraints

• Swiss engagements are precise about scope and documentation, and tolerate fewer surprises than UK projects.
• Multilingual stakeholder groups are normal: German-speaking head office, French-speaking region, English-language group reporting.
• Expect strict supplier onboarding, including security questionnaires and in some cases background checks before any data access.

In Switzerland, professional secrecy duties and client expectation push data to stay in-country far more strongly than elsewhere in Europe, and FINMA outsourcing expectations require documented control over the provider including a tested exit plan. Those are board-level questions, not IT decisions.

A 90-day plan that produces evidence

1. Days 1 to 15: assessAccess extract versus policy, data map, classification gaps, retention reality. Output is a risk-ranked remediation plan, ordered by exposure rather than by ease.
2. Days 15 to 35: defineNamed owners and stewards, a classification scheme, retention rules and access standards, all signed off by legal and by the business rather than written by the data team alone.
3. Days 35 to 70: implementPurview scanning and catalogue populated, labels published and applied, access rebuilt onto groups, lineage switched on, suppression implemented in measures.
4. Days 70 to 90: evidenceAccess evidence reporting, audit pack generation, steward training, and the first governance review run with your team rather than for them.

That sequence works because each stage produces something usable on its own. If the programme stops after the assessment, you still hold a risk-ranked plan an auditor would accept. Book a technical review if you want that assessment for a La Chaux-de-Fonds organisation.

We work across Switzerland and deliver into neighbouring markets regularly. Nearby pages worth reading if your group has sites elsewhere: Neuchâtel, Biel/Bienne, Fribourg, Yverdon-les-Bains, Rapperswil-Jona and Solothurn.

Frequently asked questions