235.11

¹The con­trol­ler of an auto­mated data file sub­ject to re­gis­tra­tion (Art. 11a para. 3 DPA) that is not ex­emp­ted from the re­gis­tra­tion re­quire­ment in terms of Art­icle 11a para­graph 5 let­ters b-d DPA shall is­sue a pro­cessing policy that de­scribes in par­tic­u­lar the in­tern­al or­gan­isa­tion and the data pro­cessing and con­trol pro­ced­ures and con­tain doc­u­ments on the plan­ning, real­isa­tion and op­er­a­tion of the data file and the in­form­a­tion tech­no­logy used.

²The con­trol­ler of the data file shall up­date the pro­cessing policy reg­u­larly. He shall make it avail­able to the Com­mis­sion­er or the data pro­tec­tion of­ficer un­der Art­icle 11a para­graph 5 let­ter e DPA on re­quest in a form that is com­pre­hens­ible to them.