Processes personal data, in Switzerland

Data Protection Ordinance (DPO / DSV / OPDo), SR 235.11, Art. 4 · Read the law's page

• Where you process a large volume of sensitive personal data by automated means, or carry out high-risk profiling, and preventive measures cannot guarantee data protection, log the storage, alteration, disclosure, deletion and destruction of the data and every access to it, keep each log for at least one year, and keep the logs separate from the processing system.

Data Protection Ordinance, SR 235.11, Art. 14, Art. 15 para. 4 · Read the law's page

• Keep each data protection impact assessment for at least two years after the processing ends.
• Document every breach of data security, with a summary of the circumstances, the effects and the measures taken, and keep the documentation for at least two years from the time of the report to the FDPIC.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31 · Read the law's page

• Have a justification, consent, an overriding private or public interest, or a legal basis, before processing personal data of a person in Switzerland in a way that would otherwise violate their personality rights.
• Distinguish your role as controller ("responsible person") or processor under FADP Article 5 lit. j-k, and allocate duties accordingly.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 12 · Read the law's page

• Maintain a record of your processing activities that names you as controller, the purpose of the processing, the categories of data subjects and of personal data, the categories of recipients and, where data go abroad, the State and the guarantees, unless the Federal Council's exception for small entities with negligible risk applies.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 16-17 · Read the law's page

• Rely on the Federal Council's adequacy list, standard contractual clauses with the Swiss-law addendum, binding corporate rules, or a narrow Article 17 derogation before moving personal data of a person in Switzerland outside an adequate jurisdiction.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24 · Read the law's page

• Notify the FDPIC as soon as possible once you become aware of a data security breach likely to result in a high risk to a Swiss data subject's personality or fundamental rights.
• Notify the affected individual only where necessary to protect them or where the FDPIC orders it; there is no fixed statutory hour count as there is under GDPR.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 25-32 · Read the law's page

• Honor a Swiss data subject's request for access, rectification, deletion or destruction, or objection to processing, and provide portability for data they gave you and that you process by automated means, under FADP Articles 25 to 32.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65 · Read the law's page

• Expect the FDPIC to be able to order you to start, change, suspend, or stop processing, or to delete or destroy data, on complaint or its own initiative, rather than to fine you directly.
• Expect the individual responsible for a willful FADP violation to face criminal liability up to CHF 250,000, and expect a Swiss data subject to be able to sue you directly in civil court for a quantifiable loss under FADP Article 32 and the Code of Obligations.

Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 5 lit. c, Art. 6 para. 7, Art. 22 · Read the law's page

• Obtain express, affirmative consent, opt-in rather than opt-out, before creating a voiceprint or other biometric identifier from a person in Switzerland, or establish another Article 6 basis for the processing.
• Perform a Data Protection Impact Assessment before large-scale processing of biometric or other sensitive personal data, or before systematic large-scale public-space monitoring, under FADP Article 22.