--- title: "Switzerland — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/switzerland/controller-processor-duties/ source_html: /jurisdictions/switzerland/controller-processor-duties/index.html description: "Switzerland — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 6 claims Amber ▾ # Core accountability infrastructure (DPIA, security, retention, breach notification) is in force" generated_at: 2026-10-25T04:46:50Z content_sha256: aff4659a22ea86e8ef665f98da594a3f6c5c81868235443ea9d8460e2d0c2713 generator: "fe-fleet/md-twin@1.0" --- # Switzerland — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules6 claimsAmber▾# Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty. Primary framework Federal Act on Data Protection (FADP), revised version, Arts 6-9, 22-24 Supervisory authority [Federal Data Protection and Information Commissioner (FDPIC / EDÖB)](http://www.edoeb.admin.ch) Traffic-light rationale — Amber Core accountability infrastructure (DPIA, security, retention, breach notification) is in force and GDPR-adjacent, but breach-notification timing and DPO-threshold specifics carry residual uncertainty. #### Sub-modules (7) #### Accountability And DpiaGreen Articles 22 and 23 of the revFADP mandate federal bodies and private persons to conduct a Data Protection Impact Assessment where data processing poses high risks to personality or fundamental rights; the FDPIC has published a factsheet with templates and flowcharts. Claims (1): - Articles 22 and 23 of the revFADP mandate federal bodies and private individuals to conduct a Data Protection Impact Assessment if data processing poses high risks to personality or fundamental rights. #### Dpo RequirementsAmber No universal mandatory DPO-appointment threshold analogous to GDPR member-state gold-plating was confirmed; the FDPIC operates a reporting portal for DPOs, suggesting appointment is encouraged/registrable rather than confirmed as strictly mandatory across all controllers in the sources reviewed. Claims (1): - The FDPIC operates a dedicated reporting portal for data protection officers, but a universally mandatory DPO-appointment threshold was not confirmed in the sources reviewed for this run. #### Ropa RequirementsGreen Controllers, including the Swiss representative for foreign controllers, are required to maintain records of processing activities and provide them to the FDPIC upon request. Claims (1): - The Swiss representative appointed by a non-Swiss controller is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC upon request. #### Joint Controller ArrangementsRed No source reviewed specified a distinct statutory joint-controller regime analogous to GDPR Art 26. Absence provenance: unavailable . Searched: FADP joint controller arrangement Article, revFADP joint controllership. #### Security MeasuresGreen Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures. Claims (1): - Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures. #### Breach NotificationAmber The revFADP introduces an obligation to notify the FDPIC of a data breach as soon as possible where it is likely to result in high risk to the data subject's personality or fundamental rights; no fixed numerical deadline equivalent to the GDPR's 72 hours was confirmed as of the guidance reviewed. Claims (1): - Controllers are obliged to inform the FDPIC of a data breach as soon as possible when it is likely to result in a high risk to the data subject's personality or fundamental rights, with no confirmed fixed statutory time limit equivalent to the GDPR's 72 hours. #### Retention And DisposalGreen Article 6(4) of the revised FADP clarifies that data must either be deleted or anonymised once the purpose for its collection has been achieved. Claims (1): - Article 6(4) of the revised FADP requires that all personal data be either deleted or anonymised once the purpose for its collection has been achieved. Category narrative 96 words The revFADP introduces mandatory DPIAs for high-risk processing (Arts 22-23), strengthened security-of-processing obligations (Art 7 FADP baseline), an explicit purpose-limitation-driven retention/disposal duty (Art 6(4)), and a new breach-notification obligation owed to the FDPIC 'as soon as possible' where a breach is likely to result in high risk, though no fixed numerical deadline (unlike the GDPR's 72 hours) was confirmed. Records-of-processing obligations attach to controllers (and, for foreign controllers, their Swiss representative). DPO appointment does not appear to carry a universal mandatory threshold as under some GDPR member-state laws; the FDPIC operates a voluntary DPO reporting portal. no periodic updates on record for this sub-brief Evidence 6 Sources and claims (6) - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-releases-factsheet-procedure) — Articles 22 and 23 of the revFADP mandate federal bodies and private individuals to conduct a Data Protection Impact Assessment if data processing poses high risks to personality or fundamental rights.observed 2026-08-03 - Uncertain[OneTrust DataGuidance](https://www.dataguidance.com/news/switzerland-fdpic-launches-new-reporting-portal-dpos) — The FDPIC operates a dedicated reporting portal for data protection officers, but a universally mandatory DPO-appointment threshold was not confirmed in the sources reviewed for this run.observed 2026-08-03 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — The Swiss representative appointed by a non-Swiss controller is responsible for maintaining the controller's record of processing activities and providing it to the FDPIC upon request.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Article 7 of the FADP requires that personal data be protected against unauthorised processing through adequate technical and organisational measures.observed 2026-08-03 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/revised-swiss-data-protection-law-soon-in-effect-with-new-scope-obligations-implications) — Controllers are obliged to inform the FDPIC of a data breach as soon as possible when it is likely to result in a high risk to the data subject's personality or fundamental rights, with no confirmed fixed statutory time limit equivalent to the GDPR's 72 hours.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/switzerland_-_third_country_assessment_guidance_note_dataguidance.pdf) — Article 6(4) of the revised FADP requires that all personal data be either deleted or anonymised once the purpose for its collection has been achieved.observed 2026-08-03