According to the Swiss Code of Obligations (Article 716), the board of directors may pass resolutions on all matters not reserved to the general meeting by law or the articles of association. The board of directors shall manage the business of the company, unless responsibility for such management has been delegated.
In addition, the new Data Protection Act (nFADP), which comes into force in September 2023, clarifies the responsibilities of each party. While it does not explicitly mention the board of directors and its members, this law stipulates that the person or body laying down the purposes and means of data processing is intrinsically the data controller. The board of directors fits within this framework and may therefore be seen as responsible.
