SwitzerlandFederal Act on Data Protection, record of processing activities
Federal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 12
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
As of .
What it requires
- Maintain a record of your processing activities that names you as controller, the purpose of the processing, the categories of data subjects and of personal data, the categories of recipients and, where data go abroad, the State and the guarantees, unless the Federal Council's exception for small entities with negligible risk applies.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 12 has the controller and the processor each keep a record of their processing activities, with the contents listed in paragraphs 2 and 3, and has federal bodies notify the FDPIC of their records (paragraph 4). The article names no log field from the log vocabulary and sets no period for the record itself; item (e) concerns the retention period of the personal data. Paragraph 5 has the Federal Council exempt legal entities with fewer than 250 employees whose processing poses a negligible risk. The article has no scope clause, and the territorial rule in Article 3 is not a section this row cites, so no territorial hook is set. The Data Protection Ordinance's logging duty in Article 4 is a separate record and sits on its own row.
- Kind
- Explicit
- As of
- Provision
- FADP Article 12
- Trigger
- personal_data_processing
What this law does
The controller and the processor must each maintain a record of their processing activities.
The controller's record contains at least its identity, the purpose of processing, a description of the categories of data subjects and of processed personal data, the categories of recipients, where possible the retention period for the personal data or the criteria for fixing it and a general description of the data security measures, and, where data are disclosed abroad, the State concerned and the guarantees.
The processor's record names the processor and the controller, the categories of processing carried out for the controller and the same security and foreign-disclosure details. Federal bodies notify the FDPIC of their records, and the Federal Council provides exceptions for legal entities with fewer than 250 employees whose processing poses a negligible risk of harm to the personality of the data subjects.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.