A one-person business still has data-protection duties

Small headcount does not make personal data small

A sole trader can hold identity, health, payment, employee, website and prospect information. Swiss data-protection duties attach to the processing and risk, not only to a large corporate structure. The FDPIC advises that a website privacy statement should clearly explain processing and that technical and organisational measures should reflect the data and risk. Cyber insurance can finance selected incident services, but it does not write the privacy notice, choose retention periods or make insecure tools lawful. Begin with the actual data journey.

Map one client from enquiry to deletion

List what arrives through ads, email, forms, messaging, appointments, invoices and cloud applications. Record purpose, legal or contractual need, access, supplier, country, retention and deletion method. Separate sensitive case notes from marketing lists and avoid collecting fields merely because a form allows them. Use unique accounts, multifactor authentication, encryption, updates and tested backups. Put confidentiality and deletion terms in supplier agreements. A short accurate register is better than a copied policy that describes tools the business does not use.

A hypothetical therapy practice

Eva runs a one-person therapy practice. Her booking tool, email provider, laptop and accountant each touch different personal data. She removes clinical questions from the public contact form, stores notes separately, activates multifactor authentication and sets a deletion calendar. She prepares a concise privacy notice and a breach checklist. When a laptop is stolen, she can identify encryption status, affected records and backups quickly, then assess notification with specialist help. The example is operational guidance, not a legal conclusion for every regulated profession.

Convenience, confidentiality and cost must be balanced

One integrated cloud suite is easier to secure consistently but increases supplier concentration. Separate tools limit one breach while multiplying passwords, exports and deletion work. Keeping every record feels safe for disputes but raises breach impact and may conflict with minimisation. Deleting too early can violate professional or tax retention needs. Strong controls cost time; informal consumer apps create hidden risk. Choose proportionate measures based on sensitivity and realistic harm, document the choice and revisit it when services, employees or client volume change.

Prepare the first hour of a data incident

Keep a device and supplier inventory, offline contact list and tested backup. Define how to isolate an account, preserve logs, reset access and continue essential work. The FDPIC guide explains notification where a breach is likely to create a high risk; the assessment requires facts, not panic. Record what happened, whose data may be affected, mitigation and decisions. Notify the cyber insurer within its timeline, but keep legal responsibility with the business. Afterwards, correct the control and update the privacy information. A small practice can be simple without being improvised.

If the practice closes temporarily, decide who can access records, answer lawful requests and notify affected people. A trusted substitute needs limited documented authority, not the owner’s master password. Include data-handling instructions in incapacity and succession planning so privacy obligations do not become impossible precisely when the sole operator is unavailable.