Federal Act
on Data Protection
(Data Protection Act, FADP)

¹ The con­trol­ler is ob­liged to ar­range the data pro­cessing in tech­nic­al and or­gan­isa­tion­al terms so that the data pro­tec­tion reg­u­la­tions, and in par­tic­u­lar the prin­ciples un­der Art­icle 6, are re­spec­ted. It shall take ac­count of this from the plan­ning stage.

² The tech­nic­al and or­gan­isa­tion­al meas­ures must in par­tic­u­lar be ap­pro­pri­ate with re­gard to the state of the art, the nature and the ex­tent of the data pro­cessing and the risk that the pro­cessing poses to the data sub­ject's per­son­al­ity or fun­da­ment­al rights.

³ The con­trol­ler is ob­liged to en­sure by means of suit­able de­fault set­tings that the pro­cessing of per­son­al data is lim­ited to the min­im­um re­quired for the pur­pose in­ten­ded, un­less the data sub­ject spe­cifies oth­er­wise.