Ordinance
on Data Protection
(Data Protection Ordinance, DPO)

¹ In or­der to guar­an­tee an ad­equate level of data se­cur­ity, the con­trol­ler and the pro­cessor must de­term­ine the ex­tent to which per­son­al data re­quires to be pro­tec­ted and ad­opt the tech­nic­al and or­gan­isa­tion­al meas­ures that are ap­pro­pri­ate to the risk.

² The ex­tent to which per­son­al data re­quires to be pro­tec­ted shall be as­sessed ac­cord­ing to the fol­low­ing cri­ter­ia:

a.

the type of the data be­ing pro­cessed;

b.

the pur­pose, nature, ex­tent and cir­cum­stances of the pro­cessing.

³ The risk for the per­son­al­ity or fun­da­ment­al rights of the data sub­ject shall be as­sessed ac­cord­ing to the fol­low­ing cri­ter­ia:

a.

the causes of the risk;

b.

the main threats;

c.

meas­ures taken or planned to re­duce the risk;

d.

the prob­ab­il­ity and ser­i­ous­ness of a breach of data se­cur­ity des­pite the meas­ures taken or planned.

⁴ When de­term­in­ing the tech­nic­al and or­gan­isa­tion­al meas­ures, the fol­low­ing cri­ter­ia shall also be con­sidered:

a.

the state of the art;

b.

the im­ple­ment­a­tion costs.

⁵ The ex­tent to which per­son­al data re­quires to be pro­tec­ted, the risk and the tech­nic­al and or­gan­isa­tion­al meas­ures shall be re­viewed throughout the peri­od of pro­cessing. The meas­ures shall be ad­jus­ted if ne­ces­sary.

The con­trol­ler and the pro­cessor must take tech­nic­al and or­gan­isa­tion­al meas­ures in or­der to en­sure, de­pend­ing on the level of pro­tec­tion re­quired, that the data be­ing pro­cessed:

a.

are only ac­cess­ible to au­thor­ised per­sons (con­fid­en­ti­al­ity);

b.

are avail­able when they are re­quired (avail­ab­il­ity);

c.

are not altered without au­thor­isa­tion or un­in­ten­tion­ally (in­teg­rity);

d.

are pro­cessed in a trace­able man­ner (trace­ab­il­ity).

¹ In or­der to guar­an­tee con­fid­en­ti­al­ity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

au­thor­ised per­sons only have ac­cess to those per­son­al data that they re­quire to ful­fil their tasks (data ac­cess con­trol);

b.

only au­thor­ised per­sons have ac­cess to the premises and fa­cil­it­ies in which per­son­al data are pro­cessed (premises and fa­cil­it­ies ac­cess con­trol);

c.

un­au­thor­ised per­sons are un­able to use auto­mated data pro­cessing sys­tems by means of data trans­mis­sion devices (user con­trol).

² In or­der to guar­an­tee avail­ab­il­ity and in­teg­rity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

un­au­thor­ised per­sons are un­able to read, copy, al­ter, move, de­lete or des­troy data car­ri­ers (data car­ri­er con­trol);

b.

un­au­thor­ised per­sons are un­able to save, read, al­ter, de­lete or des­troy stored per­son­al data (stor­age con­trol);

c.

un­au­thor­ised per­sons are un­able to read, copy, al­ter, de­lete or des­troy per­son­al data in the event of the dis­clos­ure of per­son­al data or when data car­ri­ers are be­ing trans­por­ted (trans­port con­trol);

d.

the avail­ab­il­ity of per­son­al data and ac­cess to them can be rap­idly re­stored in the event of a phys­ic­al or tech­nic­al in­cid­ent (res­tor­a­tion);

e.

all func­tions of the auto­mated data pro­cessing sys­tem are avail­able (avail­ab­il­ity), mal­func­tions are re­por­ted (re­li­ab­il­ity) and stored per­son­al data can­not be dam­aged by sys­tem mal­func­tions (data in­teg­rity);

f.

op­er­at­ing sys­tems and ap­plic­a­tion soft­ware al­ways meet the latest se­cur­ity stand­ards and known crit­ic­al vul­ner­ab­il­it­ies are re­solved (sys­tem se­cur­ity).

³ In or­der to guar­an­tee trace­ab­il­ity, the con­trol­ler and the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that:

a.

it can be veri­fied what per­son­al data were entered or altered in the auto­mated data pro­cessing sys­tem at what time and by which per­son (entry con­trol);

b.

it can be veri­fied to whom per­son­al data are dis­closed with the aid of data trans­mis­sion devices (dis­clos­ure con­trol);

c.

breaches of data se­cur­ity are re­cog­nised rap­idly (re­cog­ni­tion) and meas­ures are taken to mit­ig­ate or elim­in­ate the con­sequences (elim­in­a­tion).

¹ If a large volume of sens­it­ive per­son­al data is pro­cessed by auto­mated means or if high-risk pro­fil­ing is car­ried out and if pre­vent­ive meas­ures are un­able to guar­an­tee data pro­tec­tion, the private con­trol­ler and its private pro­cessor must as a min­im­um / log the stor­age, al­ter­a­tion, read­ing, dis­clos­ure, de­le­tion and de­struc­tion of the data. A log file must in par­tic­u­lar be kept if oth­er­wise it would not be pos­sible to es­tab­lish wheth­er the data has been pro­cessed for the pur­poses for which it was col­lec­ted or dis­closed.

² The re­spons­ible fed­er­al body and its pro­cessor shall in the case of auto­mated pro­cessing of per­son­al data log as a min­im­um the stor­age, al­ter­a­tion, read­ing, dis­clos­ure, de­le­tion and de­struc­tion of the data.

³ In the case of per­son­al data that are gen­er­ally ac­cess­ible to the pub­lic, logs shall be kept as a min­im­um of the stor­age, al­ter­a­tion, de­le­tion and de­struc­tion of the data.

⁴ The log file must provide in­form­a­tion about the iden­tity of the per­son that car­ried out the pro­cessing, the form, date and time of pro­cessing, and, if ap­plic­able, the iden­tity of the re­cip­i­ent of the data.

⁵ The log files must be re­tained for at least one year and kept sep­ar­ate from the sys­tem in which the per­son­al data are pro­cessed. They may only be made ac­cess­ible to the bod­ies and per­sons that are re­quired to re­view the ap­plic­a­tion of the data pro­tec­tion reg­u­la­tions or to safe­guard or re­store the con­fid­en­ti­al­ity, in­teg­rity, avail­ab­il­ity and trace­ab­il­ity of the data, and may only be used for this pur­pose.

¹ The private con­trol­ler and its private pro­cessor must is­sue reg­u­la­tions on auto­mated pro­cessing if they:

a.

pro­cess a large volume of sens­it­ive per­son­al data; or

b.

carry out high-risk pro­fil­ing.

² The reg­u­la­tions must in par­tic­u­lar in­clude de­tails of the in­tern­al or­gan­isa­tion­al struc­ture, data pro­cessing and con­trol pro­ced­ures and the meas­ures that guar­an­tee data se­cur­ity.

³ The private con­trol­ler and its private pro­cessor must up­date the reg­u­la­tions reg­u­larly. If a data pro­tec­tion of­ficer has been ap­poin­ted, the reg­u­la­tions must be made avail­able to the of­ficer.

¹ The re­spons­ible fed­er­al body and its pro­cessor must is­sue pro­cessing reg­u­la­tions for auto­mated pro­cessing if they:

a.

pro­cess sens­it­ive per­son­al data;

b.

carry out pro­fil­ing;

c.

pro­cess per­son­al data in ac­cord­ance with Art­icle 34 para­graph 2 let­ter c FADP;

d.

al­low can­tons, for­eign au­thor­it­ies, in­ter­na­tion­al or­gan­isa­tions or private per­sons ac­cess to per­son­al data;

e.

link data col­lec­tions with each oth­er; or

f.

op­er­ate an in­form­a­tion sys­tem or man­age data col­lec­tions with oth­er fed­er­al au­thor­it­ies.

² The reg­u­la­tions must in par­tic­u­lar in­clude de­tails of the in­tern­al or­gan­isa­tion­al struc­ture, data pro­cessing and con­trol pro­ced­ures, and the meas­ures that guar­an­tee data se­cur­ity.

³ The re­spons­ible fed­er­al body and its pro­cessor must up­date the reg­u­la­tions reg­u­larly and make them avail­able to the data pro­tec­tion of­ficer.

¹ The pri­or ap­prov­al from the con­trol­ler that al­lows the pro­cessor to as­sign the data pro­cessing to a third party may be spe­cif­ic or gen­er­al in its scope.

² In the case of gen­er­al ap­prov­al, the pro­cessor shall in­form the con­trol­ler of any plan to en­gage ad­di­tion­al or re­place ex­ist­ing third parties. The con­trol­ler may ob­ject to such changes.

¹ The States, ter­rit­or­ies, spe­cified sec­tors in a State and in­ter­na­tion­al bod­ies that guar­an­tee an ad­equate level of data pro­tec­tion are lis­ted in An­nex 1.

² When as­sess­ing wheth­er a State, a ter­rit­ory, a spe­cified sec­tor in a State or an in­ter­na­tion­al body guar­an­tees an ad­equate level of data pro­tec­tion, the fol­low­ing cri­ter­ia in par­tic­u­lar shall be con­sidered:

a.

the in­ter­na­tion­al ob­lig­a­tions of the State or in­ter­na­tion­al body, in par­tic­u­lar in re­la­tion to data pro­tec­tion;

b.

wheth­er it re­spects the rule of law and hu­man rights;

c.

the le­gis­la­tion ap­plic­able, in par­tic­u­lar to data pro­tec­tion, its im­ple­ment­a­tion and the rel­ev­ant case law;

d.

that data sub­jects’ rights and re­dress are ef­fect­ively guar­an­teed;

e.

the ef­fect­ive func­tion­ing of one or more in­de­pend­ent au­thor­it­ies in the State con­cerned that are re­spons­ible for data pro­tec­tion or to which an in­ter­na­tion­al body is ac­count­able and that have suf­fi­cient powers and re­spons­ib­il­it­ies.

³ The Fed­er­al Data Pro­tec­tion and In­form­a­tion Com­mis­sion­er (FD­PIC) shall be con­sul­ted in the course of each as­sess­ment. The as­sess­ments of in­ter­na­tion­al bod­ies or for­eign au­thor­it­ies re­spons­ible for data pro­tec­tion may be taken in­to ac­count.

⁴ The ad­equacy of the data pro­tec­tion shall be re­as­sessed peri­od­ic­ally.

⁵ The as­sess­ments shall be made pub­lic.

⁶ If the as­sess­ment un­der para­graph 4 or oth­er in­form­a­tion show that an ad­equate level of data pro­tec­tion is no longer guar­an­teed, An­nex 1 shall be amended; this shall have no ef­fect on dis­clos­ures of data already car­ried out.

¹ The data pro­tec­tion clauses in an agree­ment un­der Art­icle 16 para­graph 2 let­ter b FADP and the spe­cif­ic guar­an­tees un­der Art­icle 16 para­graph 2 let­ter c FADP must in­clude at least the fol­low­ing points:

a.

the re­quire­ment to ap­ply the prin­ciples of leg­al­ity, good faith, pro­por­tion­al­ity, trans­par­ency, pur­pose lim­it­a­tion and ac­cur­acy;

b.

the cat­egor­ies of per­son­al data dis­closed and of data sub­jects;

c.

the man­ner and pur­pose of the dis­clos­ure of per­son­al data;

d.

if ap­plic­able, the names of the coun­tries or in­ter­na­tion­al or­gan­isa­tions, in which per­son­al data is to be dis­closed and the re­quire­ments for dis­clos­ure;

e.

the re­quire­ments for safe­guard­ing, de­let­ing and des­troy­ing per­son­al data;

f.

the re­cip­i­ents or the cat­egor­ies of re­cip­i­ents;

g.

the meas­ures to guar­an­tee data se­cur­ity;

h.

the re­quire­ment to re­port breaches of data se­cur­ity;

i.

if the re­cip­i­ents are con­trol­lers: the re­quire­ment to in­form the data sub­jects about the pro­cessing;

j.

the rights of data sub­jects, and in par­tic­u­lar:

1.

the right to in­form­a­tion and the right to the data port­ab­il­ity,

2.

the right to ob­ject to the dis­clos­ure of per­son­al data,

3.

the right to the cor­rec­tion, de­le­tion or de­struc­tion of their data,

4.

the right to re­quest an in­de­pend­ent au­thor­ity for ju­di­cial pro­tec­tion.

² The con­trol­ler and, in the case of data pro­tec­tion clauses in an agree­ment, the pro­cessor must take ap­pro­pri­ate meas­ures to en­sure that the re­cip­i­ent com­plies with these clauses or the spe­cif­ic guar­an­tees.

³ If the FD­PIC is in­formed about the data pro­tec­tion clauses in an agree­ment or the spe­cif­ic guar­an­tees, the duty to provide in­form­a­tion is deemed ful­filled for all fur­ther dis­clos­ures that:

a.

are made in ac­cord­ance with the same data pro­tec­tion clauses or guar­an­tees, provided the cat­egor­ies of re­cip­i­ents, pur­pose of pro­cessing and data cat­egor­ies es­sen­tially re­main un­changed; or

b.

take place with­in the same leg­al en­tity or com­pany or between com­pany that be­long to the same group of com­pan­ies.

¹ If the con­trol­ler or the pro­cessor dis­closes per­son­al data abroad based on stand­ard data pro­tec­tion clauses in ac­cord­ance with Art­icle 16 para­graph 2 let­ter d FADP, it shall take ap­pro­pri­ate meas­ures to en­sure that the re­cip­i­ent com­plies there­with.

² The FD­PIC shall pub­lish a list of stand­ard data pro­tec­tion clauses that it has ap­proved, is­sued or re­cog­nised. It shall give no­tice of the res­ult of its as­sess­ment of stand­ard data pro­tec­tion clauses that it has been sub­mit­ted with­in 90 days.

¹ Bind­ing cor­por­ate rules in ac­cord­ance with Art­icle 16 para­graph 2 let­ter e FADP ap­ply to all un­der­tak­ings that be­long to the same group of un­der­tak­ings.

² They shall in­clude as a min­im­um the points men­tioned in Art­icle 9 para­graph 1 as well as the fol­low­ing in­form­a­tion:

a.

de­tails of the or­gan­isa­tion­al struc­ture and the con­tact de­tails for the group of un­der­tak­ings and its mem­bers;

b.

de­tails of the meas­ures taken with­in the group of un­der­tak­ings to com­ply with the bind­ing cor­por­ate rules.

³ The FD­PIC shall give no­tice of the res­ult of its as­sess­ment of the bind­ing cor­por­ate rules that it has been sub­mit­ted with­in 90 days.

¹ Per­son­al data may be dis­closed abroad if a code of con­duct or cer­ti­fic­a­tion guar­an­tees an ad­equate level of data pro­tec­tion.

² The code of con­duct must be sub­mit­ted be­fore­hand to the FD­PIC for ap­prov­al.

³ The code of con­duct or cer­ti­fic­a­tion must be com­bined with a bind­ing and en­force­able ob­lig­a­tion for the con­trol­ler or the pro­cessor in the third State to ap­ply the meas­ures con­tained therein.

The con­trol­ler must provide the data sub­ject with in­form­a­tion on the col­lec­tion of per­son­al data in a pre­cise, trans­par­ent, com­pre­hens­ible and eas­ily ac­cess­ible form.

The con­trol­ler must re­tain the data pro­tec­tion im­pact as­sess­ment after con­clud­ing the data pro­cessing for a min­im­um of two years.

¹ The re­port to the FD­PIC of a breach of data se­cur­ity must in­clude the fol­low­ing in­form­a­tion:

a.

the form of breach;

b.

the time and dur­a­tion, if pos­sible;

c.

the cat­egor­ies and ap­prox­im­ate amount of per­son­al data con­cerned, if pos­sible;

d.

the cat­egor­ies and the ap­prox­im­ate num­ber of data sub­jects, if pos­sible;

e.

the con­sequences, in­clud­ing any risks, for the data sub­jects;

f.

the meas­ures that have been taken or are planned in or­der to rem­edy the breach and mit­ig­ate the con­sequences, in­clud­ing any risks;

g.

the name and the con­tact de­tails of a con­tact per­son.

² If the con­trol­ler is un­able to re­port all the de­tails at one time, it shall sup­ply the miss­ing de­tails as quickly as pos­sible.

³ If the con­trol­ler is re­quired to in­form the data sub­ject, it shall provide the data sub­ject with the de­tails spe­cified in para­graph 1 let­ters a and e–g in simple and com­pre­hens­ible lan­guage.

⁴ The con­trol­ler must doc­u­ment the breaches. The doc­u­ment­a­tion must con­tain a sum­mary of the cir­cum­stances of the in­cid­ents, their ef­fects and the meas­ures taken. It shall be re­tained from the time of the re­port un­der para­graph 1 for a min­im­um of two years.

¹ Any per­son who re­quests in­form­a­tion from the con­trol­ler as to wheth­er per­son­al data re­lat­ing to him or her are be­ing pro­cessed must do so in writ­ing. If the con­trol­ler agrees, the re­quest may also be made verbally.

² The in­form­a­tion shall be provided in writ­ing or in the form in which the data is avail­able. By agree­ment with the con­trol­ler, the data sub­ject may in­spect his or her data on site. The in­form­a­tion may be provided verbally if the data sub­ject agrees.

³ In­form­a­tion may be re­ques­ted and provided elec­tron­ic­ally.

⁴ The in­form­a­tion must be giv­en to the data sub­ject in a com­pre­hens­ible form.

⁵ The con­trol­ler must take ap­pro­pri­ate meas­ures to identi­fy the data sub­ject. The data sub­ject is ob­liged to co­oper­ate in the iden­ti­fic­a­tion pro­cess.