How Swiss Public Sector Organizations Benefit from MyWorkDrive

By Dan Gordon

Last Updated: September 15, 2026

In November 2025, Privatim, the Conference of Swiss Data Protection Commissioners, adopted a resolution with direct consequences for how public bodies can use cloud and SaaS platforms. Cantons are drafting their own information security laws for rollout through 2026, tenders are now testing these requirements directly, and the Privatim resolution discussed below gives data protection officers a specific, citable standard rather than a general principle. Together, these developments have turned a longstanding legal framework into an active procurement criterion.

The Privatim Resolution and Swiss Cloud Data Protection Rules

The resolution establishes that international SaaS solutions can only be used for particularly sensitive personal data or legally confidential data if that data is encrypted by the organization itself, with the cloud provider having no access to the encryption key. Privatim considers most current cloud deployments involving major international providers effectively non-compliant under this standard.

Source: Privatim resolution (PDF, German)

The canton of Zurich moved first. Its data protection office has taken the position that foreign legal obligations make transferring personal data to a provider under US jurisdiction problematic the moment that data enters the provider's infrastructure, and it has extended this thinking to anything covered by professional secrecy, including medical records, tax data, social security information, and education records. Other cantons are expected to follow a similar line as their own procurement and information security rules catch up. The February 2026 market consultation for Swiss health data infrastructure, for example, already states that infrastructure components must have no technical or legal dependency on external jurisdictions.

revFADP, nLPD, and the US CLOUD Act Risk for Swiss Public Bodies

The revised Federal Act on Data Protection, known as revFADP or nLPD, has been in force since September 2023 and forms the baseline data protection law for any organization processing personal data in Switzerland. It sits alongside cantonal data protection acts, which each canton maintains on top of the federal law, and alongside the federal Informationssicherheitsgesetz (ISG), which already applies to cantons when they touch federal data or systems and which several cantons are actively extending into their own cantonal versions right now.

Sources: kmu.admin.ch, admin.ch and bacs.admin.ch (ISG), privatim.ch, kaio.fin.be.ch, ag.ch, zg.ch, so.ch. The federal cybersecurity office (BACS) confirms the ISG applies to cantons when they access classified federal information or federal IT resources.

The legal concern underneath all of this is the US CLOUD Act, which obliges providers under US jurisdiction to hand over data on request, regardless of where the servers physically sit. That means a Swiss data center address alone doesn't resolve the exposure if the operator can be compelled by a foreign authority. For a canton, hospital, or municipality bound by professional secrecy, that's not an acceptable risk to carry. This is a live legislative moment across Switzerland, not a settled one, and it's part of why interest in alternatives has picked up so quickly.

Secure File Access Without Data Migration: Where MyWorkDrive Fits

MyWorkDrive doesn't ask an organization to move its files anywhere. It's a secure file access gateway that connects to file servers, SharePoint, NAS, and other storage an organization already runs, without migrating or duplicating data into a third-party store. For a Swiss public body trying to satisfy Privatim's guidance, that distinction matters: there's no copy of sensitive data sitting with an outside provider to encrypt around, because the data never leaves the organization's own infrastructure in the first place. Access, authentication, and audit logging happen at the gateway, while control over the underlying files and their location stays exactly where it already was.

This also addresses a question Swiss buyers reasonably ask upfront: MyWorkDrive is a US-headquartered company, so why doesn't that reintroduce the CLOUD Act exposure discussed above. The answer is architectural rather than contractual. MyWorkDrive doesn't host, store, or hold a copy of customer files anywhere, in the US or otherwise. The files stay on the customer's own servers, on premises or in infrastructure the customer controls, and MyWorkDrive's role is limited to providing the access gateway. There's no customer data sitting on MyWorkDrive-operated infrastructure for a foreign authority to compel disclosure of, which is a different position than a SaaS or cloud storage vendor is in. That makes the vendor's country of incorporation far less consequential here than it would be for a platform that actually stores the data itself, and it's part of why the fit works even though MyWorkDrive isn't a Swiss or European product.

Cantonal and Municipal Administration File Access Use Case

A canton's IT department can give staff secure remote access to case files stored on an internal Windows file server, without opening that server directly to the internet and without migrating years of records into a cloud platform that may fall under foreign jurisdiction. Access stays tied to existing Active Directory accounts, and every file access is logged. See how this applies to government agencies more broadly.

Healthcare Data Access Under Swiss Confidentiality and Data Protection Law

Hospitals and clinics operate under confidentiality obligations that extend to their IT vendors and auxiliary staff. A hospital can let clinicians and administrative staff reach patient-related files from outside the building while keeping those files on servers the hospital itself controls, addressing both the professional secrecy obligation and the data security requirements tied to health data under Swiss data protection law.

Non-Profit File Access Without a Cloud Migration Project

Smaller organizations often run lean IT teams and can't take on a multi-year migration project just to give a distributed staff or volunteer base access to shared files. MyWorkDrive lets them connect existing storage and grant access in hours rather than months, while keeping donor and beneficiary data on infrastructure they already manage.

Multi-Site and Federated Organization File Access

Cantons with multiple departments, healthcare networks with several facilities, and non-profits with regional chapters often have file storage spread across different servers and locations. A gateway approach lets each site keep its own storage and administrative boundaries while still giving authorized staff a single, controlled way to reach the files they need.

Frequently Asked Questions

What is the Privatim resolution and why does it affect cloud storage in Switzerland?

Privatim is the Conference of Swiss Data Protection Commissioners. Its November 2025 resolution states that public bodies can only use international SaaS platforms for sensitive or legally confidential data if the organization itself controls the encryption keys and the provider cannot access the data. Most current deployments of major international cloud platforms do not meet that bar.

Does storing data in a Swiss data center satisfy Swiss data protection requirements?

Not on its own. If the provider operating that data center is subject to US jurisdiction, the US CLOUD Act can still require it to hand over data on request regardless of where the servers are physically located. Swiss authorities increasingly look at who controls the infrastructure and under what law, not just where the hardware sits.

What is revFADP or nLPD?

revFADP, also referred to as nLPD, is the revised Federal Act on Data Protection, in force in Switzerland since September 2023. It sets the baseline requirements for processing personal data and applies alongside cantonal data protection acts and the federal Informationssicherheitsgesetz.

How does MyWorkDrive help Swiss government and public-sector organizations meet these requirements?

MyWorkDrive is a secure file access gateway rather than a storage platform. It connects to file servers, SharePoint, NAS, and similar storage that an organization already operates, without migrating or copying data into a third-party store. Since the data never leaves the organization's own infrastructure, there is no external copy of sensitive data for a third-party provider to hold or potentially be compelled to disclose.

Is MyWorkDrive suitable for smaller organizations like non-profits?

Yes. Because it connects to existing storage rather than requiring a migration, organizations with limited IT resources can set up secure file access in hours rather than undertaking a lengthy migration project.

MyWorkDrive is a US company. Does that create the same CLOUD Act risk as a US cloud provider?

No, because the underlying exposure is about where data is stored and who holds it, not where the vendor is incorporated. MyWorkDrive doesn't host or store customer files at all. Files remain on the customer's own servers, and MyWorkDrive provides the gateway that controls access to them. Since there's no customer data sitting on MyWorkDrive's infrastructure, there's no data for a foreign authority to compel MyWorkDrive to hand over. That's a structurally different position from a SaaS or cloud storage vendor, and it's why the fit holds even though MyWorkDrive isn't a Swiss or EU-based product.

Start a free trialBook a demoView pricing