SwitzerlandData Protection Ordinance, retention of the impact assessment and breach documentation
Data Protection Ordinance, SR 235.11, Art. 14, Art. 15 para. 4
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
As of .
What it requires
- Keep each data protection impact assessment for at least two years after the processing ends.
- Document every breach of data security, with a summary of the circumstances, the effects and the measures taken, and keep the documentation for at least two years from the time of the report to the FDPIC.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Log retention
Article 14 counts the two years from the conclusion of the data processing for the impact assessment, and Article 15(4) counts them from the time of the breach report for the breach documentation; neither sets a maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 2
Logging duty
Article 15(4) has the controller document every breach of data security, whether or not it is reported, with a summary of the circumstances, the effects and the measures taken, and retain the documentation for at least two years from the report under Article 15(1). Article 14 has the controller retain its data protection impact assessment for at least two years after the processing ends; the duty to carry out the assessment is in the Act, not in this article. Neither article says that the FDPIC may demand the record, so no audit or access route is set from them. Neither article has a scope clause, so no territorial hook is set.
- Kind
- Explicit
- As of
- Provision
- Data Protection Ordinance Article 14; Article 15, paragraph 4
- Trigger
- personal_data_processing
- security_incident
What this law does
The controller must retain a data protection impact assessment for a minimum of two years after concluding the data processing. The controller must also document every breach of data security: the documentation contains a summary of the circumstances of the incidents, their effects and the measures taken, and is retained for a minimum of two years from the time of the report to the FDPIC.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.