SwitzerlandData Protection Ordinance, logging of automated processing
Data Protection Ordinance (DPO / DSV / OPDo), SR 235.11, Art. 4
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Where you process a large volume of sensitive personal data by automated means, or carry out high-risk profiling, and preventive measures cannot guarantee data protection, log the storage, alteration, disclosure, deletion and destruction of the data and every access to it, keep each log for at least one year, and keep the logs separate from the processing system.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Integrity control
Log retention
Article 4(5) requires the log files to be retained for at least one year; it sets no maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
Article 4(1) binds a private controller and its private processor when sensitive data are processed in large volume by automated means or high-risk profiling is carried out and preventive measures cannot guarantee data protection; Article 4(2) binds a responsible federal body and its processor more widely, with a written assessment of the need for logging that goes to the FDPIC on request (Article 4(2bis)). The log lists who processed the data, the form, date and time and the recipient (Article 4(4)), and the log files are retained at least one year and kept separate from the processing system (Article 4(5)). The second sentence of Article 4(5) opens the logs to the bodies and persons that review the application of the data protection regulations or safeguard the data, without naming them; the FDPIC is the authority that supervises that application. The article has no scope clause, so no territorial hook is set.
- Kind
- Explicit
- As of
- Provision
- Data Protection Ordinance Article 4
- Trigger
- personal_data_processing
What this law does
Where a large volume of sensitive personal data is processed by automated means, or high-risk profiling is carried out, and preventive measures cannot guarantee data protection, a private controller and its private processor must at least log the storage, alteration, disclosure, deletion and destruction of the data and any access to it. The log file shows who carried out the processing, the form, date and time of processing and, where relevant, the recipient.
It is retained for at least one year, kept separate from the system that processes the data, and made accessible only to the bodies and persons required to review the application of the data protection regulations or to safeguard or restore the confidentiality, integrity, availability and traceability of the data.
A federal body logs its automated processing of sensitive personal data, its profiling and its processing within Directive (EU) 2016/680, and decides after a written risk assessment whether to log other automated processing.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.