itSMF Switzerland - Blog #Switzerland

Europe and Switzerland's strategic dilemma: tariffs, tech, and data governance

Wed, 05 Nov 2025 07:00:00 +0100

Reading time: ~ 4 min.

Introduction

The global economic landscape is increasingly marked by strategic competition that goes beyond simple trade rivalry. Tariffs, technological restrictions, and conflicting regulations are testing supply chains and companies’ operating models.

In this complex scenario, European businesses, including Swiss firms, must balance two opposing needs: maintaining historical ties with the United States while pursuing greater strategic autonomy.

US pressure: tariffs and technological influence

The economic and political alliance between Europe and the United States has long been a cornerstone. However, in recent years, protectionist policies have strained this relationship.

The U.S. has imposed tariffs not only to protect its industries but also as a geopolitical lever, creating uncertainty for companies operating across the Atlantic. This pressure also extends to the tech sector, where U.S. regulations exert significant control, often at the expense of European interests.

The European response: the «Latombe's case» as a sign of change

In response to these dynamics, Europe is seeking to assert its strategic independence.

A significant example is the initiative of French MEP Philippe Latombe, who questioned the legitimacy of data transfers to the United States by criticizing the Data Privacy Framework (DPF). This move is not just a technical dispute but a strong political signal reflecting the will to strengthen European digital sovereignty.

Latombe’s position highlights growing dissatisfaction with agreements that fail to adequately protect European data from external interference, despite regulations such as LPD/GDPR.

Companies at the centre of tension: a delicate balance

In this clash between geopolitical blocs, companies find themselves in a vulnerable position.

On the one hand, they must comply with strict European regulations, risking sanctions in the event of violations. On the other hand, they are heavily dependent on American technologies and services, such as cloud providers and essential software.

This creates a dilemma: adopt alternative solutions to comply with regulations, often at higher costs, or maintain existing dependencies, exposing themselves to legal and operational risks.

The most at-risk sectors and strategies for the future

The most vulnerable companies are those managing large volumes of sensitive data belonging to European citizens or relying on U.S. technological infrastructures. For these businesses, the challenge is not only compliance but also operational continuity. Possible solutions focus on three main directions:

Diversifying technological partnerships: reducing reliance on a single provider by exploring global alternatives.
Investing in European technologies: favouring cloud and software providers based in Europe, fully compliant with local regulations such as LPD/GDPR.
Advanced data management: implementing strategies to map and control data flows, minimizing extra-European transfers.

Strategic alignment between CEO and CIO: solutions in an uncertain context

In a landscape of extreme uncertainty, it is difficult for companies to directly influence political activities or anticipate geopolitical moves.

However, strategic alignment between CEOs and CIOs can guide concrete actions to mitigate risks. Business leaders can focus on diversifying markets and investing in EU-based digital solutions that are fully GDPR compliant. This approach not only reduces vulnerability but also strengthens operational resilience.

If the DPF were annulled in the future — a possibility that remains despite the court’s recent confirmation — there would no longer be a solid legal basis for transatlantic data transfers, leading to service disruptions, operational issues, and potential sanctions. In such a scenario, companies should prepare contingency plans, including:

Immediate assessment of data flows: identifying and quantifying transfers to the U.S. to prioritize interventions.
Accelerated transition to European providers: speeding up migration to EU-compliant alternatives such as sovereign clouds or hybrid solutions.
Development of data localization strategies: implementing data residency policies to keep both sensitive and non-sensitive data within European borders.
Training and internal governance: aligning IT teams and executives on risk protocols, with scenario-based disruption simulations.

This alignment between strategic vision (CEO) and technological implementation (CIO) transforms uncertainty into opportunity, promoting a «Europe-first» approach that balances innovation and compliance.

Conclusion: an opportunity for new European leadership

Geopolitical tensions, while creating uncertainty, may represent a unique opportunity for Europe. Current challenges push companies torethink their technological dependence and invest in a more autonomous digital ecosystem.

This shift toward greater sovereignty could foster the emergence of European leadership not only in regulation but also in technology. Companies that anticipate this trend by embracing digital sovereignty will not only protect themselves from future instability but also position themselves as key players in a new era, guided by values of autonomy and innovation.

Author: Angela Pedàlina

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter: you will get a monthly update with the most relevant and valuable content from our experts!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

FINMA requirements for ICT resources in Swiss finance industry: GRC approach and main related standards

Wed, 20 Sep 2023 07:00:00 +0200

Reading time: ~ 4 min.

The ICT resources requirements for Swiss finance industry set by FINMA

As you probably already know, in Switzerland FINMA – Eidgenössische Finanzmarktaufsicht; autorité fédérale de surveillance des marchés financiers; autorità federale di vigilanza sui mercati finanziari – is the Financial Market Supervisory Authority.

This authority set indeed a lot of mandatory requirements for all the financial industry players and in particular today we're going to take a closer look at the FINMA Circular 2023/1.

The document has been issued in January 2023 by the authority and it is intended to substitute the previous one – the old Circular 08/21.

In the following lines, we're going to better figure out the main ICT resources requirements set by FINMA for the Swiss financial market that, we have to keep in mind that are subjected to supervision.

The Swiss finance industry ICT resources requirements set by FINMA 23/01 Circular

First of all, we would like to focus our examination on the «Chapter IV» of the aforementioned Circular 23/01 issued by FINMA, due to our GRC approach.

This fourth chapter of the document is indeed about the «Management of Operational Risks» and set in particular these six details:

✅ A. Transversal Management of Operational Risks

✅ B. ICT Risk Management

✅ C. Cyber Risk Management

✅ D. Risk management of critical data

✅ E. Business continuity management (BCM)

✅ F. Management of risks relating to the provision of cross-border services

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

How to manage the ICT requirements for Swiss finance industry set by FINMA according to the more relevant ISO standards

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

Information security
Business continuity
IT services.

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

ISO 38500, for the Governance;
ISO 31000, for the Risk Management;
ISO 37301, for the Compliance Management.

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

📘 ISO 27001 «information security standard», ISO 27110 «cybersecurity framework standard» and the NIST standard;

📘 ISO 22301 «business continuity standard»;

📘 ISO 20000-1 «IT services standard».

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.

We end our brief overview on the FINMA requirements on ICT resources set by the Circular 2023/1 inviting you to stay tuned on our blog, social media channels and newsletter, to be always updated on the next news about this topic.

Don't forget to support our effort to bring you the best content quality and sharing value: follow us on our YouTube channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

GRC and personal data transfer from Switzerland: the standard contractual clauses

Thu, 14 Oct 2021 07:00:22 +0200

Reading time: ~ 2 min.

The transfer of personal data to a country with an inadequate level of data protection: the role of standard contractual clauses (SCC)

During the past months, we had an overview on personal data protection and privacy topics several times.

We had a focus indeed on Swiss FADP (LPD-DSG) and EU GDPR requirements.

Today we are going to take a closer look to a big threat, taken so seriously by the Swiss lawmaker. The transfer of personal data to a country without an adequate level of data protection on its laws.

In particular we will show you the relevance of the role of standard contractual clauses (SCC) on this matter.

The Federal Data Protection and Information Commissioner provisions

As is known, on August 27th, 2021 the Federal Data Protection and Information Commissioner of Switzerland (FDPIC) has released provisions concerning the transfer of personal data to a country with an inadequate level of data protection, based on recognised standard contractual clauses (SCC) and model contracts.

The FDPIC (the Swiss Data Protection Authority) commented on the issue of non-EU transfers, focusing more specifically on the SCCs approved by the European Commission.

In fact, the FDPIC has officially recognised the standard contractual clauses as a legitimate condition for the transfer of personal data to those countries that do not have an adequate level of data protection, albeit with due care and modification.

More precisely, the FDPIC - in its ruling - distinguishes the hypothesis of the transfer to which only the Swiss law on data protection applies (and which, therefore, has no connection with the GDPR), from the hypothesis in which the GDPR applies to the processing pursuant to Article 3(2), but the exporter is a Data Controller or Manager located in Switzerland (and therefore subject to Swiss law).

In this case - according to the FDPIC - the parties may choose whether to draw up two separate agreements (one under GDPR and the other under Swiss data protection law) or to refer to a single regime, subjecting all transfers to GDPR standards, but providing for the appropriate adjustments.

Andrea Leonardi (Vice President of MGS)
Anna Capoluongo (Lawyer)

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: the FADP/LPD Ordinance

Wed, 18 Aug 2021 06:00:50 +0200

Reading time: ~ 2 min.

The data protection in Switzerland and GRC: our quick focus on FAPD (LPD) Ordinance

On our previous posts, we took a look firstly at the data protection in Switzerland. We secondly compared the GRC approach for Swiss organizations across the GPDR and LPD contexts.

Today we will focus on a particular aspect of the Swiss laws on privacy: the FADP Ordinance.

On 23th June 2021, the Federal Council of Switzerland launched the consultation on LPD-DSG-LPD Ordinance (OLPD). It will last until 14th October 2021.

The main goal is the adaptation of the executive provisions contained in this ordinance (OLPD) relating to the Federal Act on Data Protection (LPD/DSG/LPD).

In particular, the OLPD will provide clarifications on some important data protection aspects such as:

minimum of data security requirements;
information obligations;
right of access to the data;
notification of data security breaches/violations;
communication of personal data abroad;
etc.

The Federal Act on Data Protection (as well as the OLPD) is expected to come into effect in the second half of 2022.

For Swiss organizations there will be a lot of challenges to face on privacy protection.This is the reason why we will focus together on this topic.

On 6th and 7th October we will held an itSMF class on GRC and Data protection with the partnership of MGS.

In conclusion, to know more details on this class as well as relevant news, you can just read our blog as well as follow us on our social channels.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and Data Protection: the GRC approch in EU and Swiss contexts

Wed, 04 Aug 2021 05:00:41 +0200

Reading time: ~ 2 min.

Data protection between EU and Switzerland: the GRC Data Protection approach on GDPR and LPD-DSG-LPD (FDA)

GRC and Data Protection: what about the approach in Switzerland?

We already told you about the new Federal Data Protection Act (also known as LPD) that was enacted in Switzerland in our previous post. Today we are getting back on this topic considering one big challenge for the Swiss companies: the GRC and data protection between European Union and Switzerland.

Many organizations in Switzerland will face a double challenge. They have to manage compliance with the requirements of the LPD and, at the same time, with GDPR too. This one - as known - applies also to the EU citizens personal data processing carried out outside of the EU.

Many Swiss companies have to find a solution that could be suitable for both the contexts.
How to manage compliance with the requirements of the LPD and the GDPR in an integrated way?

The adoption of a common GRC approach (Governance, Risk Management, Compliance) based on the main ISO standards can be of great help.

This can be the right choice with particular reference to the following standards:

Risk management according to ISO 31000
Privacy Impact Assesment on ISO 29134
Compliance management (ISO 37301)
Information security management system (ISO 27001)
Business continuity management system (ISO 22301)
IT Service Management System (ISO 20000-1).

Due to this high relevance for a lot of companies, we will have a special focus on topic with a dedicated class.

ITSMF and MGS will have a partnership on the next class about GRC and Data protection between EU and Switzerland.

We will held this class on 6th and 7th October: but you will get more info about during the next weeks.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program

GRC and data protection in Switzerland: structure and main requirements of the LPD

Thu, 22 Jul 2021 05:00:08 +0200

Reading time: ~ 2 min.

Data protection in Switzerland: the Swiss Federal Data Protection Act (DPA)

As is known, on September 25th, 2020, the Federal Data Protection Act (LPD) of Switzerland was enacted.
The LPD - similarly to the GDPR - has a three levels structure: you can find on it chapters, sections and single articles.
There are many clear correlations between the requirements of the Swiss LPD and the requirements of the European GDPR. These are:
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
The purpose and field of application.
The definition of personal data and processing.
The figures involved (data subject, data controller and data processor).
The applicable principles to the processing.
The rights of the data subject.
The privacy by design and by default.
The obligations of data controllers and processors.
The personal data protection.
The role of the data protection consultant.
How to manage the compliance with the requirements of the Swiss LPD? What is the right answer? Remember, every company has to pay attention to and comply with this act!

The adoption of a GRC (Governance, Risk Management and Compliance) approach based on the main ISO standards can be particularly useful, so we will check it on our next blog posts.

We are going to see how it is possible to execute everything in the right way in the next weeks: so please stay tuned!

Keep in mind also that we are going to take a deeper and closer look at this crucial topic on our next class by itSMF with the partnership of MGS.

This class is going to be scheduled on 6th and 7th October. We will keep you in touch shortly with some details and of course the enrollment.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe the itSMF Newsletter

DISCOVER THE EVENT CALENDAR

Enter the itSMF Membership Program