type: legislation

jurisdiction: Switzerland

text: 235.1English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.Federal Acton Data Protection(FADP) of 19 June 1992 (Status as of 1 March 2019)The Federal Assembly of the Swiss Confederation,based on Articles 95, 122 and 173 paragraph 2 of the Federal Constitution1,2 and having regard to the Federal Council Dispatch dated 23 March 19883,decrees:1 SR 1012 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).3 BBl 1988 II 413Section 1 Aim, Scope and Definitions  Art. 1 Aim  This Act aims to protect the privacy and the fundamental rights of persons when their data is processed.Art. 2 Scope  1 This Act applies to the processing of data pertaining to natural persons and legal persons by:a.private persons;b.federal bodies.2 It does not apply to:a.personal data that is processed by a natural person exclusively for personal use and which is not disclosed to outsiders;b.deliberations of the Federal Assembly and in parliamentary committees;c.pending civil proceedings, criminal proceedings, international mutual assistance proceedings and proceedings under constitutional or under administrative law, with the exception of administrative proceedings of first instance;d.public registers based on private law;e.personal data processed by the International Committee of the Red Cross.Art. 3 Definitions  The following definitions apply:a.personal data (data): all information relating to an identified or identifiable person;b.data subjects: natural or legal persons whose data is processed;c.sensitive personal data: data on:1.religious, ideological, political or trade union-related views or activities,2.health, the intimate sphere or the racial origin,3.social security measures,4.administrative or criminal proceedings and sanctions;d.personality profile: a collection of data that permits an assessment of essential characteristics of the personality of a natural person;e.processing: any operation with personal data, irrespective of the means applied and the procedure, and in particular the collection, storage, use, revision, disclosure, archiving or destruction of data;f.disclosure: making personal data accessible, for example by permitting access, transmission or publication;g.data file: any set of personal data that is structured in such a way that the data is accessible by data subject;h.federal bodies: federal authorities and services as well as persons who are entrusted with federal public tasks;i.4controller of the data file: private persons or federal bodies that decide on the purpose and content of a data file;j.5formal enactment:1.federal acts,2.decrees of international organisations that are binding on Switzerland and international treaties containing legal rules that are approved by the Federal Assembly;k.6…4 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).5 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).6 Repealed by No I of the FA of 24 March 2006, with effect from 1 Jan. 2008  (AS 2007 4983; BBl 2003 2101).Section 2 General Data Protection Provisions  Art. 4 Principles  1 Personal data may only be processed lawfully.72 Its processing must be carried out in good faith and must be proportionate.3 Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided for by law.4 The collection of personal data and in particular the purpose of its processing must be evident to the data subject.85 If the consent of the data subject is required for the processing of personal data, such consent is valid only if given voluntarily on the provision of adequate information. Additionally, consent must be given expressly in the case of processing of sensitive personal data or personality profiles.97 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).8 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).9 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 5 Correctness of the data  1 Anyone who processes personal data must make certain that it is correct. He must take all reasonable measures to ensure that data that is incorrect or incomplete in view of the purpose of its collection is either corrected or destroyed.102 Any data subject may request that incorrect data be corrected.10 Second sentence inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 611 Cross-border disclosure  1 Personal data may not be disclosed abroad if the privacy of the data subjects would be seriously endangered thereby, in particular due to the absence of legislation that guarantees adequate protection.2 In the absence of legislation that guarantees adequate protection, personal data may be disclosed abroad only if:a.sufficient safeguards, in particular contractual clauses, ensure an adequate level of protection abroad;b.the data subject has consented in the specific case;c.the processing is directly connected with the conclusion or the performance of a contract and the personal data is that of a contractual party;d.disclosure is essential in the specific case in order either to safeguard an overriding public interest or for the establishment, exercise or enforcement of legal claims before the courts;e.disclosure is required in the specific case in order to protect the life or the physical integrity of the data subject;f.the data subject has made the data generally accessible and has not expressly prohibited its processing;g.disclosure is made within the same legal person or company or between legal persons or companies that are under the same management, provided those involved are subject to data protection rules that ensure an adequate level of protection.3 The Federal Data Protection and Information Commissioner (the Commissioner, Art. 26) must be informed of the safeguards under paragraph 2 letter a and the data protection rules under paragraph 2 letter g. The Federal Council regulates the details of this duty to provide information.11 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 7 Data security  1 Personal data must be protected against unauthorised processing through adequate technical and organisational measures.2 The Federal Council issues detailed provisions on the minimum standards for data security.Art. 7a12  12 Inserted by No I of the FA of 24 March 2006 (AS 2007 4983; BBl 2003 2101). Repealed by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, with effect from 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 8 Right to information  1 Any person may request information from the controller of a data file as to whether data concerning them is being processed.2 The controller of a data file must notify the data subject:13a.14of all available data concerning the subject in the data file, including the available information on the source of the data;b.the purpose of and if applicable the legal basis for the processing as well as the categories of the personal data processed, the other parties involved with the file and the data recipient.3 The controller of a data file may arrange for data on the health of the data subject to be communicated by a doctor designated by the subject.4 If the controller of a data file has personal data processed by a third party, the controller remains under an obligation to provide information. The third party is under an obligation to provide information if he does not disclose the identity of the controller or if the controller is not domiciled in Switzerland.5 The information must normally be provided in writing, in the form of a printout or a photocopy, and is free of charge. The Federal Council regulates exceptions.6 No one may waive the right to information in advance.13 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).14 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 915 Limitation of the duty to provide information   1 The controller of a data file may refuse, restrict or defer the provision of information where:a.a formal enactment so provides;b.this is required to protect the overriding interests of third parties.2 A federal body may further refuse, restrict or defer the provision of information where:a.this is required to protect overriding public interests, and in particular the internal or external security of the Confederation;b.the information would jeopardise the outcome of a criminal investigation or any other investigation proceedings.3 As soon as the reason for refusing, restricting or deferring the provision of information ceases to apply, the federal body must provide the information unless this is impossible or only possible with disproportionate inconvenience or expense.4 The private controller of a data file may further refuse, restrict or defer the provision of information where his own overriding interests so require and he does not disclose the personal data to third parties.5 The controller of a data file must indicate the reason why he has refused, restricted or deferred access to information.15 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 10 Limitations of the right to information for journalists  1 The controller of a data file that is used exclusively for publication in the edited section of a periodically published medium may refuse to provide information, limit the information or defer its provision provided:a.the personal data reveals the sources of the information;b.access to the drafts of publications would have to be given;c.the freedom of the public to form its opinion would be prejudiced.2 Journalists may also refuse restrict or defer information if the data file is being used exclusively as a personal work aid.Art. 10a16 Data processing by third parties  1 The processing of personal data may be assigned to third parties by agreement or by law if:a.the data is processed only in the manner permitted for the instructing party itself; andb.it is not prohibited by a statutory or contractual duty of confidentiality.2 The instructing party must in particular ensure that the third party guarantees data security.3 Third parties may claim the same justification as the instructing party.16 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 1117 Certification procedure  1 In order to improve data protection and data security, the manufacturers of data processing systems or programs as well as private persons or federal bodies that process personal data may submit their systems, procedures and organisation for evaluation by recognised independent certification organisations.2 The Federal Council shall issue regulations on the recognition of certification procedures and the introduction of a data protection quality label. In doing so, it shall take account of international law and the internationally recognised technical standards.17 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 11a18 Register of data files  1 The Commissioner maintains a register of data files that is accessible online. Anyone may consult the register.2 Federal bodies must declare all their data files to the Commissioner in order to have them registered.3 Private persons must declare their data files if:a.they regularly process sensitive personal data or personality profiles; orb.they regularly disclose personal data to third parties.4 The data files must be declared before they are opened.5 In derogation from the provisions in paragraphs 2 and 3, the controller of data files is not required to declare his files if:a.private persons are processing the data in terms of a statutory obligation;b.the Federal Council has exempted the processing from the registration requirement because it does not prejudice the rights of the data subjects;c.he uses the data exclusively for publication in the edited section of a periodically published medium and does not pass on any data to third parties without informing the data subjects;d.the data is processed by journalists who use the data file exclusively as a personal work aid;e.he has designated a data protection officer who independently monitors internal compliance with data protection regulations and maintains a list of the data files;f.he has acquired a data protection quality mark under a certification procedure in accordance with Article 11 and has notified the Commissioner of the result of the evaluation.6 The Federal Council regulates the modalities for the declaration of data files for registration, the maintenance and the publication of the register, the appointment and duties of the data protection officer under paragraph 5 letter e and the publication of a list of controllers of data files that are relieved of the reporting obligation under paragraph 5 letters e and f.18 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Section 3 Processing of Personal Data by Private Persons  Art. 12 Breaches of privacy  1 Anyone who processes personal data must not unlawfully breach the privacy of the data subjects in doing so.2 In particular, he must not:a.process personal data in contravention of the principles of Articles 4, 5 paragraph 1 and 7 paragraph 1;b.process data pertaining to a person against that person’s express wish without justification;c.disclose sensitive personal data or personality profiles to third parties without justification.193 Normally there is no breach of privacy if the data subject has made the data generally accessible and has not expressly prohibited its processing.19 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 13 Justification  1 A breach of privacy is unlawful unless it is justified by the consent of the injured party, by an overriding private or public interest or by law.2 An overriding interest of the person processing the data shall in particular be considered if that person:a.processes personal data in direct connection with the conclusion or the performance of a contract and the personal data is that of a contractual party;b.is or intends to be in commercial competition with another and for this purpose processes personal data without disclosing the data to third parties;c.process data that is neither sensitive personal data nor a personality profile in order to verify the creditworthiness of another, and discloses such data to third parties only if the data is required for the conclusion or the performance of a contract with the data subject;d.processes personal data on a professional basis exclusively for publication in the edited section of a periodically published medium;e.processes personal data for purposes not relating to a specific person, in particular for the purposes of research, planning and statistics and publishes the results in such a manner that the data subjects may not be identified;f.collects data on a person of public interest, provided the data relates to the public activities of that person.Art. 1420 Duty to provide information on the collection of sensitive personal data and personality profiles  1 The controller of the data file is obliged to inform the data subject of the collection of sensitive personal data or personality profiles; this duty to provide information also applies where the data is collected from third parties.2 The data subject must be notified as a minimum of the following:a.the controller of the data file;b.the purpose of the processing;c.the categories of data recipients if a disclosure of data is planned.3 If the data is not collected from the data subject, the data subject must be informed at the latest when the data is stored or if the data is not stored, on its first disclosure to a third party.4 The duty of the controller of the data file to provide information ceases to apply if the data subject has already been informed or, in cases under paragraph 3, if:a.the storage or the disclosure of the data is expressly provided for by law; orb.the provision of information is not possible or possible only with disproportionate inconvenience or expense.5 The controller of the data file may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 4.20 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 1521 Legal claims  1 Actions relating to protection of privacy are governed by Articles 28, 28a and 28l of the Civil Code22. The plaintiff may in particular request that data processing be stopped, that no data be disclosed to third parties, or that the personal data be corrected or destroyed.2 Where it is impossible to demonstrate that personal data is accurate or inaccurate, the plaintiff may request that a note to this effect be added to the data.3 The plaintiff may request that notification of third parties or the publication of the correction, destruction, blocking, and in particular the prohibition of disclosure to third parties, the marking of the data as disputed or the court judgment.4 Actions on the enforcement of a right to information shall be decided by the courts in a simplified procedure under the Civil Procedure Code of 19 December 200823.21 Amended by Annex 1 No II 14 of the Civil Procedure Code of 19 Dec. 2008, in force since 1 Jan. 2011 (AS 2010 1739; BBl 2006 7221).22 SR 21023 SR 272Section 4 Processing of Personal Data by Federal Bodies  Art. 16 Responsible body and controls24  1 The federal body that processes or arranges for the processing of personal data in fulfilment of its tasks is responsible for data protection.2 If federal bodies process personal data together with other federal bodies, with cantonal bodies or with private persons, the Federal Council may specifically regulate the control of and responsibility for data protection.2524 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).25 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 17 Legal basis  1 Federal bodies may process personal data if there is a statutory basis for doing so.2 They may process sensitive personal data and personality profiles only if a formal enactment expressly provides therefor or if, by way of exception:a.such processing is essential for a task clearly defined in a formal enactment;b.the Federal Council authorises processing in an individual case because the rights of the data subject are not endangered; orc.the data subject has given his consent in an individual case or made his data general accessible and has not expressly prohibited its processing.2626 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 17a27 Automated data processing in pilot projects  1 The Federal Council may, having consulted the Commissioner and before a formal enactment comes into force, approve the automated processing of sensitive personal data or personality profiles if:a.the tasks that require such processing required are regulated in a formal enactment;b.adequate measures are taken to prevent breaches of privacy;c.a test phase before the formal enactment comes into force is indispensable for the practical implementation of data processing.2 A test phase may be mandatory for the practical implementation of data processing if:a.the fulfilment of a task requires technical innovations, the effects of which must first be evaluated;b.the fulfilment of a task requires significant organisational or technical measures, the effectiveness of which must first be tested, in particular in the case of cooperation between federal and the cantonal bodies; orc.processing requires that sensitive personal data or personality profiles be transmitted online to cantonal authorities.3 The Federal Council shall regulate the modalities of automated data processing in an ordinance.4 The competent federal body shall provide the Federal Council with an evaluation report at the latest within two years of the pilot system coming into operation. The report contains a proposal on whether the processing should be continued or terminated.5 Automated data processing must be terminated in every case if within five years of the pilot systems coming into operation no formal enactment has come in force that contains the required legal basis.27 Inserted by No I of the FA of 24 March 2006 (AS 2006 4873; BBl 2003 2101,  2006 3547). Amended by No I of the FA of 24 March 2006, in force since 15 Dec. 2006 (AS 2007 4983; BBl 2003 2101).Art. 18 Collection of personal data  1 In the case of systematic surveys, in particular by means of questionnaires, the federal organ shall disclose the purpose of and the legal basis for the processing, and the categories of persons involved with the data file and of the data recipients.2 …2828 Repealed by No I of the FA of 24 March 2006, with effect from 1 Jan. 2008  (AS 2007 4983; BBl 2003 2101).Art. 18a29 Duty to provide information on the collection of personal data  1 Federal bodies are obliged to inform the data subject of the collection of personal data; this duty to provide information also applies where the data is collected from third parties.2 The data subject must be notified as a minimum of the following:a.the controller of the data file;b.the purpose of processing;c.the categories of the data recipients where a disclosure of data is planned;d.the right to information in accordance with Article 8;e.the consequences of the refusal of the data subject to provide the requested personal data.3 If the data is not collected from the data subject, the data subject must be informed at the latest when the data is stored or if the data is not stored, on its first disclosure to a third party.4 The duty of the controller of the data file to provide information ceases to apply if the data subject has already been informed or, in cases under paragraph 3, if:a.the storage or the disclosure of the data is expressly provided for by law; orb.the provision of information is not possible or possible only with disproportionate inconvenience or expense.5 If the duty to provide information would compromise the competitiveness of a federal body, the Federal Council may limit the application of the duty to the collection of sensitive personal data and personality profiles.29 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 18b30 Restriction of the duty to provide information  1 Federal bodies may refuse, restrict or defer the provision of information subject to the requirements of Article 9 paragraphs 1 and 2.2 As soon as the reason for refusal, restriction or deferral ceases to apply, the federal bodies are bound by the duty to provide information unless compliance is not possible or possible only with disproportionate inconvenience or expense.30 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387; BBl 2009 6749).Art. 19 Disclosure of personal data  1 Federal bodies may disclose personal data if there is legal basis for doing so in accordance with Article 17 or if:31a.the data is indispensable to the recipient in the individual case for the fulfilment of his statutory task;b.32the data subject has consented in the individual case;c.33the data subject has made the data generally accessible and has not expressly prohibited disclosure; ord.the recipient demonstrates credibly that the data subject is withholding consent or blocking disclosure in order to prevent the enforcement of legal claims or the safeguarding of other legitimate interests; the data subject must if possible be given the opportunity to comment beforehand.1bis Federal bodies may also disclose personal data within the terms of the official information disclosed to the general public, either ex officio or based on the Freedom of Information Act of 17 December 200434 if:a.the personal data concerned is connected with the fulfilment of public duties; and b.there is an overriding public interest in its disclosure.352 Federal bodies may on request also disclose the name, first name, address and date of birth of a person if the requirements of paragraph1 are not fulfilled.3 Federal bodies may make personal data accessible online if this is expressly provided for. Sensitive personal data and personality profiles may be made accessible online only if this is expressly provided for in a formal enactment.363bis Federal bodies may make personal data generally accessible by means of automated information and communication services if a legal basis is provided for the publication of such data or if they make information accessible to the general public on the basis of paragraph1bis. If there is no longer a public interest in the accessibility of such data, the data concerned must be removed from the automated information and communication service.374 The federal body shall refuse or restrict disclosure, or make it subject to conditions if:a.essential public interests or clearly legitimate interests of a data subject so require orb.statutory duties of confidentiality or special data protection regulations so require.31 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).32 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).33 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).34 SR 152.335 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).36 Second sentence according to No I of the FA of 24 March 2006, with effect from  1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).37 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).Art. 20 Blocking disclosure  1 A data subject that credibly demonstrates a legitimate interest may request the federal body concerned to block the disclosure of certain personal data.2 The federal body shall refuse to block disclosure or lift the block if:a.there is a legal duty of disclosure; orb.the fulfilment of its task would otherwise be prejudiced.3 Any blocking of disclosure is subject to Article 19 paragraph 1bis.3838 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).Art. 2139 Offering documents to the Federal Archives  1 In accordance with the Archiving Act of 26 June 199840, federal bodies shall offer the Federal Archives all personal data that is no longer in constant use.2 The federal bodies shall destroy personal data designated by the Federal Archives as not being of archival value unless it:a.is rendered anonymous;b.41must be preserved on evidentiary or security grounds or in order to safeguard the legitimate interests of the data subject.39 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).40 SR 152.141 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 22 Processing for research, planning and statistics  1 Federal bodies may process personal data for purposes not related to specific persons, and in particular for research, planning and statistics, if:a.the data is rendered anonymous, as soon as the purpose of the processing permits;b.the recipient only discloses the data with the consent of the federal body andc.the results are published in such a manner that the data subjects may not be identified.2 The requirements of the following provisions need not be fulfilled:a.Article 4 paragraph 3 on the purpose of processingb.Article17 paragraph 2 on the legal basis for the processing of sensitive personal data and personality profiles;c.Article 19 paragraph 1 on the disclosure of personal data.Art. 23 Private law activities of federal bodies  1 If a federal body acts under private law, the provisions for the processing of personal data by private persons apply.2 Supervision is governed by the provisions on federal bodies.Art. 2442 42 Repealed by Art. 31 of the FA of 21 March 1997 on Measures to Safeguard Internal Security, with effect from 1 July 1998 (AS 1998 1546; BBl 1994 II 1127).Art. 25 Claims and procedure  1 Anyone with a legitimate interest may request the federal body concerned to:a.refrain from processing personal data unlawfully;b.eliminate the consequences of unlawful processing;c.ascertain whether processing is unlawful.2 If it is not possible to prove the accuracy or the inaccuracy of personal data, the federal body must mark the data correspondingly.3 The applicant may in particular request that the federal body:a.corrects or destroys the personal data or blocks its disclosure to third parties;b.communicates its decision to third parties, in particular on the correction, destruction, blocking of the data or marking of the data as disputed, or publishes the decision.4 The procedure is governed by the Federal Act of 20 December 196843 on Administrative Procedure (Administrative Procedure Act). The exceptions contained in Articles 2 and 3 of the Administrative Procedure Act do not apply.5 …4443 SR 172.02144 Repealed by Annex No 26 of the Administrative Court Act of 17 June 2005, with effect from 1 Jan. 2007 (AS 2006 2197; BBl 2001 4202).Art. 25bis 45 Procedure in the event of the disclosure of official  documents containing personal data  For as long as proceedings relating to access to official documents within the meaning of the Freedom of Information Act of 17 December 200446 that contain personal data are ongoing, the data subject may within the terms of such proceedings claim the rights accorded to him on the basis of Article 25 of this Act in relation to those documents that are the subject matter of the access proceedings.45 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).46 SR 152.3Section 5 Federal Data Protection and Information Commissioner  Art. 2647 Appointment and status  1 The Commissioner is appointed by the Federal Council for a term of office of four years. The appointment must be approved by the Federal Assembly.1bis This term of office shall be extended automatically unless the Federal Council has issued an order no less than six months before its expiry based on materially adequate grounds that the term of office should not be extended.482 The employment relationship is governed by the Federal Personnel Act of 24 March 200049, unless this Act provides otherwise.3 The Commissioner shall exercise his duties independently, without receiving directives from any authority.50 He is assigned to the Federal Chancellery for administrative purposes.3 He has a permanent secretariat and his own budget. He appoints his own staff.5 The Commissioner is not subject to the system of assessment under Article 4 paragraph 3 of the Federal Personnel Act of 24 March 2000.47 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).48 Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).49 SR 172.220.150 Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).Art. 26a51 Reappointment and termination of the term of office  1 The Commissioner’s term of office may be extended twice.521bis This term of office shall be extended automatically unless the Federal Council has issued an order based on materially adequate grounds that the term of office should not be extended.532 The Commissioner may request the Federal Council to be discharged from office at the end of any month subject to six months advance notice.3 The Federal Council may dismiss the Commissioner from office before the expiry of his term of office if he:a.wilfully or through gross negligence seriously violates his duties of office; or b.he is permanently unable to fulfil his duties of office.51 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).52 Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).53 Inserted by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).Art. 26b54 Secondary occupation   1 The Commissioner may not carry on another occupation. 2 The Federal Council may permit the Commissioner to carry on another occupation provided this does not compromise his independence and standing. The decision shall be published.54 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (AS 2010 3387 3418; BBl 2009 6749). Amended by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since 1 March 2019 (AS 2019 625; BBl 2017 6941).Art. 27 Supervision of federal bodies  1 The Commissioner55 supervises compliance by federal bodies with this Act and other federal data protection regulations of the Confederation. The Federal Council is excluded from such supervision.2 The Commissioner investigates cases either on his own initiative or at the request of a third party.3 In investigating cases, he may request the production of files, obtain information and arrange for processed data to be shown to him. The federal bodies must assist in determining the facts of any case. The right to refuse to testify under Article 16 of the Administrative Procedure Act56 applies by analogy.4 If the investigation reveals that data protection regulations are being breached, the Commissioner shall recommend that the federal body concerned change the method of processing or abandon the processing. He informs the department concerned or the Federal Chancellery of his recommendation.5 If a recommendation is not complied with or is rejected, he may refer the matter to the department or to the Federal Chancellery for a decision. The decision is communicated to the data subjects in the form of a ruling.576 The Commissioner has a right of appeal against the ruling under paragraph 5 and against the decision of the appeal authority.5855 Term in accordance with Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963). This amendment is taken into account throughout this Act.56 SR 172.02157 Second sentence according to No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).58 Inserted by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 28 Advice to private persons  The Commissioner advises private persons on data protection matters.Art. 29 Investigations and recommendations in the private sector  1 The Commissioner shall investigate cases in more detail on his own initiative or at the request of a third party if:a.methods of processing are capable of breaching the privacy of larger number of persons (system errors);b.59data files must be registered (Art. 11a);c.60there is a duty to provide information in terms of Article 6 paragraph 3.2 To this end, he may request files, obtain information and arrange for processed data to be shown to him. The right to refuse to testify under Article 16 of the Administrative Procedure Act61 applies by analogy.3 On the basis of his investigations, the Commissioner may recommend that the method of processing be changed or abandoned.4 If a recommendation made by the Commissioner is not complied with or is rejected, he may refer the matter to the Federal Administrative Court for a decision. He has the right to appeal against this decision.6259 Amended by No I of the FA of 24 March 2006, in force since 1Jan. 2008 (AS 2007 4983; BBl 2003 2101).60 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).61 SR 172.02162 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 30 Information  1 The Commissioner shall submit a report to the Federal Assembly at regular intervals and as required. He shall provide the Federal Council with a copy of the report at the same time. The regular reports are published.632 In cases of general interest, he informs the general public of his findings and recommendations. He may only publish personal data subject to official secrecy with consent of the authority responsible. If it refuses its consent, the President of the division of the Federal Administrative Court responsible for data protection makes the final decision.6463 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).64 Wording of sentence according to Annex No 26 of the Administrative Court Act of 17 June 2005, in force since 1 Jan. 2007 (AS 2006 2197 1069; BBl 2001 4202).Art. 31 Additional tasks  1 The Commissioner has the following additional tasks in particular:65a.he assists federal and cantonal bodies on data protection issues;b.he provides an opinion on draft federal legislation and on other federal measures that are relevant to data protection;c.he cooperates with domestic and foreign data protection authorities;d.66he provides an expert opinion on the extent to which foreign data protection legislation guarantees adequate protection;e.67he examines safeguards and data protection rules notified to him under Article 6 paragraph 3;f.68he examines the certification procedure under Article11 and may issue recommendations in accordance with Article 27 paragraph 4 or Article 29 paragraph 3;.g.69he carries out the tasks assigned to him under the Freedom of Information Act of 17 December 200470;h.71he shall raise the level of public awareness of data protection matters.2 He may also advise bodies of the Federal Administration even if, in accordance with Article 2 paragraph 2 letters c and d, this Act does not apply. The bodies of the Federal Administration may permit him to inspect their files.65 Amended by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004, in force since 1 July 2006 (AS 2006 2319; BBl 2003 1963).66 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).67 Inserted by Annex No 4 of the Freedom of Information Act of 17 Dec. 2004  (AS 2006 2319; BBl 2003 1963). Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).68 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).69 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).70 SR 152.371 Inserted by No II 1 of the FA of 28 Sept. 2018 on the Implementation of Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, in force since  1 March 2019 (AS 2019 625; BBl 2017 6941).Art. 3272 72 Repealed by Annex No I of the FA of 30 Sept. 2011 on Research involving Human Beings, with effect from 1 Jan. 2014 (AS 2013 3215; BBl 2009 8045).Section 673 Legal Protection 73 Amended by Annex No 26 des Administrative Court Act of 17 June 2005, in force since  1 Jan. 2007 (AS 2006 2197 1069; BBl 2001 4202). Art. 33 1 Legal protection is governed by the general provisions on the administration of federal justice.2 If the Commissioner establishes in a case investigation under Article 27 paragraph 2 or under Article 29 paragraph 1 that the data subjects are threatened with a disadvantage that cannot be easily remedied, he may apply to the President of the division of the Federal Administrative Court responsible for data protection for interim measures to be taken. The procedure is governed by analogy by Articles 79–84 of the Federal Act of 4 December 194774 on Federal Civil Procedure.74 SR 273Section 7 Criminal Provisions  Art. 34 Breach of obligations to provide information, to register or to cooperate  1 On complaint, private persons are liable to a fine if they:75a.breach their obligations under Articles 8–10 and 14, in that they wilfully provide false or incomplete information; orb.wilfully fail:1.to inform the data subject in accordance with Article 14 paragraph 1, or2.to provide information required under Article 14 paragraph 2.762 Private persons are liable to a fine77 if they wilfully:a.78fail to provide information in accordance with Article 6 paragraph 3 or to declare files in accordance with Article11a or who in doing so wilfully provide false information; orb.provide the Commissioner with false information in the course of a case investigation (Art. 29) or who refuse to cooperate.75 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).76 Amended by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).77 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).78 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008 (AS 2007 4983; BBl 2003 2101).Art. 35 Breach of professional confidentiality  1 Anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their professional activities where such activities require the knowledge of such data is, on complaint, liable to a fine.792 The same penalties apply to anyone who without authorisation wilfully discloses confidential, sensitive personal data or personality profiles that have come to their knowledge in the course of their activities for a person bound by professional confidentiality or in the course of training with such a person.3 The unauthorised disclosure of confidential, sensitive personal data or personality profiles remains an offence after termination of such professional activities or training.79 Amended by Art. 333 of the Criminal Code in the version of the FA of 13 Dec. 2002, in force since 1 Jan. 2007 (AS 2006 3459; BBl 1999 1979).Section 8 Final Provisions  Art. 36 Implementation  1 The Federal Council shall issue the implementing provisions.2 …803 It may provide for derogations from Articles 8 and 9 in relation to the provision of information by Swiss diplomatic and consular representations abroad.4 It may also specify:a.which data files require processing regulations;b.the requirements under which a federal body may arrange for the processing of personal data by a third party or for a third party;c.how the means of identification of persons may be used.5 It may conclude international treaties on data protection provided they comply with the principles of this Act.6 It regulates how data files must be secured where the data may constitute a danger to life and limb for the data subjects in the event of war or other crisis.80 Repealed by Art. 25 of the Archiving Act of 26 June 1998, with effect from 1 Oct. 1999  (AS 1999 2243; BBl 1997 II 941).Art. 37 Implementation by the cantons  1 Unless there are cantonal data protection regulations that ensure an adequate level of protection, Articles 1–11a, 16, 17, 18–22 and 25 paragraphs 1–3 of this Act apply to the processing of personal data by cantonal bodies in the implementation of federal law.812 The cantons shall appoint a controlling body to ensure compliance with data protection requirements. Articles 27, 30 and 31 are applicable in an analogous manner.81 Amended by No I of the FA of 24 March 2006, in force since 1 Jan. 2008  (AS 2007 4983; BBl 2003 2101).Art. 38 Transitional provisions  1 The controllers of data files must register existing data files that must be registered under Article 11 within one year of the commencement of this Act at the latest.2 They must take the required measures within one year of the commencement of this Act to be able to provide the information required under Article 8.3 Federal bodies may continue to use an existing data file with sensitive personal data or with personality profiles until 31 December 2000 without fulfilling the requirements of Article 17 paragraph 2.824 In matters relating to asylum and foreign nationals, the period mentioned in paragraph 3 is extended until the commencement of the totally revised Asylum Act of 26 June 199883 and the amendments to the Federal Act of 26 March 193184 on the Residence and Permanent Settlement of Foreign Nationals.8582 Amended by No I of the FD of 26 June 1998, in force until 31 Dec. 2000 (AS 1998 1586; BBl 1998 1579 1583).83 SR 142.3184 [BS 1 121; AS 1949 221, 1987 1665, 1988 332, 1990 1587 Art. 3 para. 2, 1991 362 No II 11 1034 No III, 1995 146, 1999 1111 2262 Annex No 1, 2000 1891 No IV 2, 2002 685 No I 1 701 No I 1 3988 Annex No 3, 2003 4557 Annex No II 2, 2004 1633 No I 1 4655 No I 1, 2005 5685 Annex No 2, 2006 979 Art. 2 No 1 1931 Art. 18 No 1 2197 Annex  No 3 3459 Annex No 1 4745 Annex No 1, 2007 359 Annex No 1. AS 2007 5437 Annex No I]85 Inserted by No II of the FD of 20 June 1997, in force since 1 Jan. 1998 (AS 1997 2372; BBl 1997 I 877). The Acts mentioned come into force on 1 Oct. 1999.Art. 38a86 Transitional provision to the Amendment of 19 March 2010  The appointment of the Commissioner and the termination of his employment relationship are subject to the previous law until the end of the legislative period in which this amendment comes into force.86 Inserted by No 3 of the FA of 19 March 2010 on the Implementation of Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, in force since 1 Dec. 2010  (AS 2010 3387 3418; BBl 2009 6749).Art. 39 Referendum and commencement  1 This Act is subject to an optional referendum.2 The Federal Council determines the date on which this Act comes into force.Commencement Date: 1 July 19938787 FCD of 14 June 1993 (AS 1993 1958).Final Provision of the Amendment of 24 March 200688 88 AS 2007 4983 Within a year of the commencement of this Act, the controllers of data files must take the required measures to inform data subjects in accordance with Article 4 paragraph 4 and Article 7a.Annex Amendment of Federal Acts …8989 The amendments may be consulted under AS 1993 1945.


text: 235.11 English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.235.11Ordinanceto the Federal Act on Data Protection(DPO)of 14 June 1993 (Status as at 16 October 2012)The Swiss Federal Council,based on Articles 6 paragraph 3, 7 paragraph 2, 8, 11a paragraph 6, 16 paragraph 2, 17a and 36 paragraphs 1, 4 and 6 of the Federal Act of 19 June 19921 on Data Protection (DPA) and on Article 46a of the Government and Administration Organisation Act of 21 March 19972,3ordains:1 SR 235.12 SR 172.0103 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Chapter 1 Processing of Personal Data by Private Persons  Section 1 Right of Access  Art. 1 Modalities  1 Anyone who requests information from the controller of a data file on whether data concerning them is being processed (Art. 8 DPA) must normally request the information in writing and provide proof of their identity.2 Requests for information as well as the provision of information may also be made online if the controller of the data file expressly arranges for this and takes appropriate measures to:a.guarantee the identification of the data subject; andb.protect the personal data of the data subject when providing information against unauthorised access by third parties.43 With the agreement of the controller of the data file or at his suggestion, the data subject may inspect their data in situ. The information may also be provided verbally if the data subject has consented and has been identified by the controller.4 The information or the substantiated decision on the restriction of the right of access (Art. 9 and 10 DPA) is provided within 30 days of receipt of the request for information. If the information cannot be provided within 30 days, the controller of the data file must notify the applicant of this and of the date by which the information will be provided.5 If one or more data files are jointly held by two or more controllers, the right of access may be asserted against each controller, unless one of them is responsible for processing all requests for information. If the controller of the data file is not authorised to provide information, he shall pass the request on to the person responsible.6 If the request for information relates to data that is being processed by a third party on behalf of the controller of the data file, the controller shall pass the request on to the third party for processing if the controller is not able to provide the information himself.57 If information is requested on data relating to deceased persons, it must be provided if the applicant proves an interest in the information that is not countered by the overriding interests of relatives of the deceased or third parties. Close relatives and persons who have been married to the deceased have a justified interest.4 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).5 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 2 Exceptions to the exemption from costs  1 The payment of an appropriate share of the costs may by way of exception be requested if:a.the applicant has already been provided with the requested information in the twelve months prior to the application and no legitimate interest in the further provision of information can be proven. A legitimate interest is constituted in particular if the personal data has been modified without notice being given to the data subject;b.the provision of information entails an exceptionally large amount of work.2 The share of the costs amounts to a maximum of 300 francs. The applicant must be notified of the amount of the share before the information is provided and may withdraw his request within ten days.Section 2 Registration of Data Files  Art. 3 Registration  1 Data files (Art. 11a para. 3 DPA) must be registered with the Federal Data Protection and Information Commissioner (the Commissioner) before their operational use.6 The registration contains the following information:a.the name and address of the controller of the data file;b.the name and complete designation of the data file;c.the person against whom the right of access may be asserted;d.the purpose of the data file;e.the categories of personal data processed;f.the categories of data recipients;g.the categories of persons participating in the data file, i.e. third parties who are permitted to enter and modify data in the data file.2 Each controller of a data file shall update this information on an ongoing basis. …76 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).7 Second sentence repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008 (AS 2007 4993).Art. 48 Exemptions from the duty to register  1 Exempt from the duty to register data files are data files as defined in Article 11a paragraph 5 letters a and c–f DPA as well as the following data files (Art. 11a para. 5 let. b DPA):a.data files from suppliers or customers, provided they do not contain any sensitive personal data or personality profiles;b.data files whose data is used exclusively for purposes unrelated to specific persons, in particular in research, planning and statistics;c.archived data files and the data that are preserved solely for historical or scientific purposes;d.data files that contain only data that has been published or that the data subjects have themselves made generally accessible and whose processing they have not expressly prohibited;e.data that exclusively serves to fulfil the requirements of Article10;f.accounting records;g.secondary data files for personnel management of the controller of the data file, provided they do not contain any sensitive personal data or personality profiles.2 The controller of the data files shall take the measures required to be able to provide the Commissioner or the data subjects on request with the information (Art. 3 para. 1) on data files not subject to the duty to register.8 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Section 3 Transborder Disclosure  Art. 59 Publication in electronic form  If personal data is made generally accessible by means of automated information and communications services for the purpose of providing information to the general public, this is not deemed to be transborder disclosure.9 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 610 Duty to provide information  1 The controller of the data file shall inform the Commissioner prior to transborder disclosure with regard to the safeguards and data protection rules under Article 6 paragraph 2 letters a and g DPA. If information cannot be provided in advance, it must be provided immediately after disclosure.2 If the Commissioner has been informed of the safeguards and the data protection rules, the duty to provide information for all additional disclosures is regarded as fulfilled if such disclosures:a.are made subject to the same safeguards, provided the categories of recipient, the purpose the processing and the data categories remain essentially unchanged; orb.take place within the same legal person or company or between legal persons or companies that are under the same management, provided the data protection rules continue to ensure an adequate level of protection.3 The duty to provide information is also regarded as fulfilled if data is transmitted on the basis of model contracts or standard contract clauses that have been drawn up or approved by the Commissioner, and the Commissioner has been informed about the use of these model contracts or standard contract clauses by the controller of the data file. The Commissioner shall publish a list of the model contracts and standard contract clauses that he has drawn up or approved.4 The controller of the data file shall take appropriate measures to ensure that the recipient complies with the safeguards and the data protection rules.5 The Commissioner examines the safeguards and the data protection rules that have been notified to him (Art. 31 para. 1 let. e DPA) and notifies the controller of the data file of the result of his examination within 30 days of receipt of the information.10 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 711 List of states with adequate data protection legislation  The Commissioner shall publish a list of the states whose legislation ensures an adequate level of protection.11 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Section 4 Technical and organisational measures  Art. 8 General measures  1 Anyone who as private individual processes personal data or provides a data communication network shall ensure the confidentiality, availability and the integrity of the data in order to ensure an appropriate level of data protection.12 In particular, he shall protect the systems against the following risks:a.unauthorised or accidental destruction;b.accidental loss;c.technical faults;d.forgery, theft or unlawful use;e.unauthorised alteration, copying, access or other unauthorised processing.2 The technical and organisational measures must be adequate. In particular, they must take account of the following criteria:a.the purpose of the data processing;b.the nature and extent of the data processing;c.an assessment of the possible risks to the data subjects;d.the current state of the art.3 These measures must be reviewed periodically.4 …1312 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).13 Repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008  (AS 2007 4993).Art. 9 Special measures  1 The controller of the data file shall, in particular for the automated processing of personal data, take the technical and organisational measures that are suitable for achieving the following goals in particular:a.entrance control: unauthorised persons must be denied the access to facilities in which personal data is being processed;b.personal data carrier control: unauthorised persons must be prevented from reading, copying, altering or removing data carriers;c.transport control: on the disclosure of personal data as well as during the transport of data carriers, the unauthorised reading, copying, alteration or deletion of data must be prevented;d.disclosure control: data recipients to whom personal data is disclosed by means of devices for data transmission must be identifiable;e.storage control: unauthorised storage in the memory as well as the unauthorised knowledge, alteration or deletion of stored personal data must be prevented;f.usage control: the use by unauthorised persons of automated data processing systems by means of devices for data transmission must be prevented;g.access control: the access by authorised persons must be limited to the personal data that they required to fulfilment their task;h.input control: in automated systems, it must be possible to carry out a retrospective examination of what personal data was entered at what time and by which person.2 The data files must be structured so that the data subjects are able to assert their right of access and their right to have data corrected.Art. 10 Records  1 The controller of the data file shall maintain a record of the automated processing of sensitive personal data or personality profiles if preventive measures cannot ensure data protection. Records are necessary in particular if it would not otherwise be possible to determine subsequently whether data has been processed for the purposes for which it was collected or disclosed. The Commissioner14 may also recommend that records be maintained of other processing.152 The records must be stored for one year in a state suitable for auditing. They are accessible only to those bodies or private persons whose duty it is to supervise compliance with the data protection regulations, and may be used only for this purpose.14 Term in accordance with Annex 2 No. 3 of the Freedom of Information Ordinance of 24 May 2006, in force since 1 July 2006 (AS 2006 2331). This amendment has been made throughout this Ordinance.15 Correction of 12 Oct. 2012, concerns only the Italian text (AS 2012 5521)Art. 1116 Processing policy  1 The controller of an automated data file subject to registration (Art. 11a para. 3 DPA) that is not exempted from the registration requirement in terms of Article 11a paragraph 5 letters b–d DPA shall issue a processing policy that describes in particular the internal organisation and the data processing and control procedures and contain documents on the planning, realisation and operation of the data file and the information technology used.2 The controller of the data file shall update the processing policy regularly. He shall make it available to the Commissioner or the data protection officer under Article 11a paragraph 5 letter e DPA on request in a form that is comprehensible to them.16 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 12 Disclosure of data  The controller of the data file shall notify the data recipient as to how up-to-date and reliable the personal data that he has disclosed is, unless this information is evident from the data itself or from the circumstances.Section 517 Data Protection Officers 17 Inserted by No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008  (AS 2007 4993). Art. 12a Appointment of the data protection officer and notice to the Commissioner  1 If the controller of the data file under Article 11a paragraph 5 letter e DPA wishes to be exempted from the duty to register the data file, he must:a.appoint an operational data protection officer who fulfils the requirements of paragraph 2 and of Article 12b; andb.notify the Commissioner of the appointment of the data protection officer.2 The controller of the data file may appoint an employee or a third party as the data protection officer. This person may not carry out any other activities that are incompatible with his duties as a data protection officer, and must have the required specialist knowledge.Art. 12b Duties and position of the data protection officer  1 The data protection officer has the following duties in particular:a.he audits the processing of personal data and recommends corrective measures if he ascertains that the data protection regulations have been infringed.b.he maintains a list of the data files in accordance with Article 11a paragraph 3 DPA that are operated by the controller of the data files; this list must be made available to the Commissioner or on request to data subjects.2 The data protection officer:a.carries out his duties independently and without instructions from the controller of the data file;b.has the resources required to fulfil his duties;c.has access to all data files and data processing as well as to all information, that he requires to fulfil his duties.Chapter 2 Processing of Personal Data by Federal Bodies  Section 1 Right of Access  Art. 13 Modalities  Articles 1 and 2 apply by analogy to requests for information made to federal bodies.Art. 14 Requests for information made to Swiss diplomatic representations abroad  1 Swiss representations abroad as well as the missions to the European Communities and to international organisations shall forward requests for information made to them to the office responsible in the Federal Department of Foreign Affairs. The Department regulates the responsibilities.182 In addition, the provisions of the Ordinance of 10 December 200419 on Military Controls apply to requests for information on military controls abroad.2018 Amended in accordance with Annex 2 No. 3 of the Freedom of Information Ordinance of 24 May 2006, in force since 1 July 2006 (SR 152.31).19 SR 511.2220 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 1521 21 Repealed by Art. 26 para. 2 of the Archiving Ordinance of 8 Sept. 1999 (SR 152.11).Section 2 Registration of Data Files  Art. 16 Registration22  1 The federal bodies responsible (Art. 16 DPA) shall register with the Commissioner all the data files that they maintain before they are opened. The registration contains the following details:a.the name and address of the responsible federal body;b.the name and complete designation of the data file;c.the body against whom the right of access may be asserted;d.the legal basis and purpose of the data file;e.the categories of processed personal data;f.the categories of the recipients of the data;g.the categories of the participants in the data file, i.e. third parties who may enter or modify data in the file.h.…232 The responsible federal body shall update these details regularly.2422 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).23 Repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008  (AS 2007 4993).24 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 1725 25 Repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008  (AS 2007 4993).Art. 1826 Exemptions from the duty to register  1 Following data files are exempted from the duty to register, provided the federal bodies use them exclusively for the internal administrative purposes:a.common correspondence registers;b.data files of supplier or clients, provided they do not contain sensitive personal data or personality profiles;c.collections of addresses used solely for addressing correspondence, provided they do not contain sensitive personal data or personality profiles;d.lists for compensation payments;e.accounting documents;f.secondary data files for federal personnel management, provided they do not contain sensitive personal data or personality profiles;g.library data files (catalogues of authors, borrower and user lists).2 The following are also exempted from the duty to register:a.data files archived in the Federal Archives;b.data files that are made available to the general public in the form of directories;c.data files where the data is used exclusively for purposes not related to specific persons, in particular in research, planning and statistics.3 The competent federal body shall take the measures required to be able to provide the Commissioner or the data subjects on request with the information (Art. 16 para. 1) on data files exempted from the duty to register.26 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Section 3 Transborder Disclosure  Art. 1927 If a federal body makes a transborder disclosure of personal data on the basis of Article 6 paragraph 2 letter a DPA known, Article 6 applies.27 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993, 2008 189).Section 4 Technical and Organisational Measures  Art. 2028 Principles  1 The federal bodies responsible shall take the technical and organisational measures required under Articles 8-10 to protect the privacy and the fundamental rights of persons whose data is being processed. In the case of the automated data processing, the federal bodies shall cooperate with the Federal Strategy Unit for IT (FSUIT).2 The federal bodies responsible shall immediately notify the data protection officer under Article 11a paragraph 5 letter e DPA or, if no officer has been appointed, the Commissioner of all projects involving the automated processing of personal data, so that data protection requirements are taken into account without delay. Notice is given to the Commissioner by way of FSUIT if the project must also be registered with the latter.293 The Commissioner and FSUIT shall cooperate on technical measures within the scope of their activities. The Data Protection Commissioner shall consult with FSUIT before recommending such measures.4 In addition, directives apply that have been issued by the federal bodies responsible based on the Federal Information Technology Ordinance of 26 September 200330.3128 Amended in accordance with Annex No. II 7 of the Ordinance on Federal Information Technology of 23 Feb. 2000 [AS 2000 1227].29 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).30 SR 172.010.5831 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 21 Processing policy  1 The federal bodies responsible shall issue a processing policy for automated data files that:a.contain sensitive data or personality profiles;b.are used by two or more federal bodies;c.are disclosed to cantons, foreign authorities, international organisations or private persons; ord.are connected to other data files.2 The federal body responsible shall determine its internal organisation in the processing policy. These shall in particular describe the data processing and control procedures and contain all documents on the planning, realisation and management of the data file. The policy shall contain the details required for registration (Art. 16) as well as information on:a.the body responsible for the protection and security of the data;b.the source of the data;c.the purposes for which the data is regularly disclosed;d.the control procedures and in particular the technical and organisational measures in terms of Article 20;e.the description of the data fields and the organisational units that have access to them;f.the access by users of the data files as well as on the nature and extent of such access;g.the data processing procedures, in particular the procedure for the rectification, blocking, anonymising, storing, safeguarding, archiving or destruction of the data;h.the configuration of the information technology used;i.the procedure for exercising the right of access.3 The policy shall be updated regularly. They shall be made available to the control bodies responsible in a form comprehensible to them.Art. 22 Data processing by third parties  1 ...322 A federal body that arranges for personal data to be processed by third parties remains responsible for data protection. It ensures that the data is processed in accordance with its instructions, in particular with regard to its use and disclosure.3 If the third party is not subject to the DPA, the responsible body shall satisfy itself that other statutory provisions ensure equivalent data protection, and if this is not the case, it shall ensure protection by contractual means.32 Repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008  (AS 2007 4993).Art. 2333 Advisor on data protection  1 The Federal Chancellery and the Departments shall each appoint at least one advisor on data protection. This advisor has the following duties:a.advising the responsible bodies and users;b.encouraging the provision of information and the training of staff;c.participating in the implementation of the data protection regulations.2 If federal bodies under Article 11a paragraph 5 letter e DPA wish to be exempted from the duty to register their data files, Articles12a and 12b apply.3 The federal bodies consult with the Commissioner with regard to the advisor.33 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Section 5 Special Provisions  Art. 2434 Collection of personal data  1 Where a federal body collects personal data systematically by means of questionnaires, it must inform persons who are not obliged to provide information that the provision of information is voluntary.34 Amended in accordance with No. 1 of the Ordinance of 4 June 2010, in force since 1 Dec. 2010 (AS 2010 3399).Art. 25 Personal identification number  1 The federal body that introduces a personal identification number for the administration of its data file shall create a non-speaking number that is used in its own area of responsibility. A non-speaking number is any set of clear or clearly identifiable characters allocated to each person registered in a data file that does not permit any conclusions to be drawn as to the person to which it relates.2 The use of the personal identification number by other federal or cantonal bodies or by private individuals must be approved by the federal body concerned.3 The approval may be granted if there is a close connection between the planned data processing and the processing for which the personal identification number has been created.4 In addition, the use of the AHV number is regulated by the AHV legislation.Art. 26 Disclosure of data  The federal body concerned shall notify the data recipient of the up-to-dateness and the reliability of the personal data that it discloses, provided this information is not evident from the data itself or from the circumstances.Art. 2735 Procedure for the authorisation of pilot scheme  1 Before consulting the interested administrative units, the federal body responsible for the pilot scheme shall inform the Commissioner as to how it is intended to ensure compliance with the requirements of Article 17a DPA, and invite him to comment thereon.2 The Commissioner shall comment on the issue of whether the licensing requirements in terms of Article 17a paragraphs 1 and 2 DPA are fulfilled. The federal body responsible shall provide him with all the documents required, and in particular with:a.a general description of the pilot scheme;b.a report that proves that the fulfilment of tasks provided for by law requires the processing of sensitive personal data or personality profiles and that a test phase before the formal enactment comes into force is indispensable (Art. 17a para. 1 let. c DPA);c.a description of the internal organisation as well as the data processing and control procedures (Art. 21);d.a description of the security and data protection measures;e.the draft of or the concept for an ordinance that regulates the details of the processing;f.information relating to the planning of the various phases of the pilot scheme.3 The Commissioner may request further documents and carry out additional investigations.4 The federal body responsible shall inform the Commissioner of any important modification relating to compliance with the requirements of Article 17a DPA. If required, the Commissioner shall again state his views thereon.5 The opinion of the Commissioner must be included in the application to the Federal Council.35 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 27a36 Analysis report for pilot schemes   The federal body responsible shall submit the draft of the analysis report for the Federal Council (Art. 17a para. 4 DPA) to the Commissioner for comment. The Federal Council must be informed of the opinion of the Commissioner.36 Inserted by No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008  (AS 2007 4993).Chapter 3 Register of Data Files, Federal Data Protection and Information Commissioner37, and Procedures before the Federal Administrative Court38 37 Term in accordance with Annex 2 No. 3 of the Freedom of Information Ordinance of 24 May 2006, in force since 1 July 2006 (AS 2006 2331).38 Term in accordance with No. II 24 of the Ordinance of 8 Nov. 2006 on the Amendment of Federal Council Ordinances in accordance with the Total Revision of the Provisions on the Administration of Federal Justice, in force since 1 Jan. 2007 (AS 2006 4705). This amendment is taken into account throughout this Ordinance.Section 1 Register and Registration of Data Files  Art. 2839 Register of data files  1 The register maintained by the Commissioner contains the information in terms of Articles 3 and 16.2 The register is accessible to the general public online. The Commissioner shall provide extracts on request free of charge.3 The Commissioner maintains a list of the controllers of data files who are exempted from the requirement to register data files in terms of Article 11a paragraph 5 letters e and f DPA. This list is accessible to the general public online.4 If the controller of the data file does not register his data file or does not do so completely, the Commissioner shall allow him a period within which to comply with his obligations. On expiry of the period, he may, based on the information available to him, register the file ex officio or recommend that the data processing be terminated.39 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 2940 40 Repealed by No. I of the Ordinance of 28 Sept. 2007, with effect from 1 Jan. 2008  (AS 2007 4993).Section 2 Federal Data Protection and Information Commissioner  Art. 30 Headquarters and legal status  1 The Commissioner’s headquarters and secretariat are located in Bern.2 The employment of the members of the Commissioner’s secretariat is governed by the Federal Personnel Act of 24 March 200041 together with its implementing provisions.423 The Commissioner’s budget is contained in a special section of the Federal Chancellery budget.4341 SR 172.220.142 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).43 Inserted by No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 31 Relations with other authorities and private individuals  1 The Commissioner deals with the Federal Council via the Federal Chancellor.44 The Federal Chancellor shall pass on any recommendations and reports from the Data Protection Commissioner irrespective of whether he or she concurs with them.1bis The Commissioner passes on the reports intended for the Federal Assembly directly to the Parliamentary Services.452 The Commissioner deals directly with other administrative units, the federal courts, foreign data protection authorities and with all other authorities and private persons that are subject to federal data protection legislation or the legislation on the principle of freedom of information in government.4644 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).45 Inserted by No. 1 of the Ordinance of 4 June 2010, in force since 1 Dec. 2010  (AS 2010 3399).46 Amended in accordance with No. II 24 of the Ordinance of 8. Nov. 2006 on the Amendment of Federal Council Ordinances in accordance with the Total Revision of the Provisions on the Administration of Federal Justice, in force since 1 Jan. 2007 (AS 2006 4705).Art. 32 Documentation  1 The federal bodies shall submit to the Commissioner any draft legislation that relates to the processing of personal data, data protection or access to official documents.47 In the area of the data protection, the departments and the Federal Chancellery notify him of their decisions in anonymised form as well as their guidelines.482 The Commissioner must have sufficient documentation made available to him in order to carry out his activities. He operates an independent information and documentation system for the administration, indexing and control of correspondence and the files as well as for the online publication of information of general interest and of the registers of data files.493 The Federal Administrative Court has access to the Commissioner’s scientific documentation.5047 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).48 Amended in accordance with Annex 2 No. 3 of the Freedom of Information Ordinance of 24 May 2006, in force since 1 July 2006 (SR 152.31).49 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).50 Amended in accordance with No. II 24 of the Ordinance of 8. Nov. 2006 on the Amendment of Federal Council Ordinances in accordance with the Total Revision of the Provisions on the Administration of Federal Justice, in force since 1 Jan. 2007  (AS 2006 4705).Art. 33 Fees  1 A fee is charged for expert opinions (Art. 28 DPA) from the Commissioner. The provisions of the General Fees Ordinance of 8 September 200451 apply.522 No fee is charged to federal administrative units, authorities and the cantons.51 SR 172.041.152 Amended in accordance with No. I of the Ordinance of 28 Sept. 2007, in force since 1 Jan. 2008 (AS 2007 4993).Art. 34 Examination of the processing of personal data  1 For the investigation of the circumstances under Articles 27 and 29 DPA, and in particular the examination of the lawfulness of data processing, the Commissioner may request the following information in particular from the controller of the data file:a.technical and organisational measures (Art. 8–10, 20) that have been taken or that are planned;b.the regulations relating to the correction, blocking, rendering anonymous, storing, safeguarding and destruction of personal data;c.the configuration of the information technology used;d.links with other data files;e.the manner of the disclosure the data;f.the description of the data fields and the organisational units that have access to them;g.the nature and extent of access by users to the data in the data file.2 In the case of transborder disclosure, the Commissioner may request additional information, in particular on the processing possibilities of the data recipient or on the data protection measures taken.Section 3 Procedure before the Federal Administrative Court  Art. 3553 1 The Federal Administrative Court may request the submission of processed data.2 It notifies the Commissioner of its decisions.53 Amended in accordance with No. II 24 of the Ordinance of 8. Nov. 2006 on the Amendment of Federal Council Ordinances in accordance with the Total Revision of the Provisions on the Administration of Federal Justice, in force since 1 Jan. 2007 (AS 2006 4705).Chapter 4 Final Provisions  Art. 36 Amendment of current law  1.–2. …543. –8. …5554 Repealed by Annex No. II 7 of the Ordinance on Federal Information Technology of 23 Feb. 2000 [AS 2000 1227].55 The amendments may be consulted under AS 1993 1962.Art. 37 Transitional provisions  1 Data files that are being processed when the DPA and this Ordinance come into force must be registered with the Commissioner by 30 June 1994.2 The technical and organisational measures (Article 8–11, 20 and 21) must be carried out in relation to all automated processing and data files within five years of this Ordinance coming into force.Art. 38 Commencement  This Ordinance comes into force on 1 July 1993.


text: 235.13 English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.Ordinanceon Data Protection Certification(DPCO)of 28 September 2007 (Status as of 1 November 2016)The Swiss Federal Council,based on Article 11 paragraph 2 of the Federal Act of 19 June 19921 on Data Protection (FADP),ordains:1 SR 235.1Section 1 Certification Organisations  Art. 1 Requirements  1 The organisations that carry out data protection certification in accordance with Article 11 FADP (certification organisations) must be accredited. Accreditation is governed by the Accreditation and Designation Ordinance of 17 June 19962, unless the present Ordinance provides otherwise.2 Separate accreditation is required in each case for the certification of:a.the organisation of and procedure for data protection;b.products (hardware, software or systems for automated data processing procedures).3 The certification organisations must have established organisational regulations and an established certification procedure (checking program), in which the following in particular are regulated:a.the assessment or checking criteria and the resultant requirements that must be fulfilled by the organisations or products to be certified (assessment and/or checking scheme); andb.the details of the procedure, and in particular the course of action in the event that irregularities are detected. 4 The minimum requirements for the checking program are governed by the standards and principles applicable in accordance with Annex 2 of the Accreditation and Designation Ordinance of 17 June 1996 and in accordance with Articles 4–6 hereof.5 The minimum qualification requirements for the staff that carry out certification procedures are set out in the Annex.2 SR 946.512Art. 2 Accreditation procedure  The Swiss Accreditation Service shall consult the Federal Data Protection and Information Commissioner (the Commissioner) on the accreditation procedure and the follow-up inspection as well as on the suspension or the withdrawal of accreditation.Art. 3 Foreign certification organisations  1 The Commissioner, in consultation with the Swiss Accreditation Service, shall recognise foreign certification organisations as being qualified to carry out their activities on Swiss territory provided they are able to prove that they hold an equivalent qualification to that required in Switzerland.2 The certification organisations must in particular provide proof that they fulfil the requirements of Article 1 paragraphs 3 and 4 and that they have adequate knowledge of Swiss data protection legislation.3 The Commissioner may place a time limit on recognition and make it subject to conditions or requirements. He shall withdraw recognition if essential conditions or requirements are not fulfilled.Section 2 Subject Matter and Procedure  Art. 4 Certification of organisation and procedure  1 The following may be certified:a.any data processing procedures for which an organisation is responsible;b.individual, separately definable data processing procedures.2 The subject matter of the assessment is the data protection management system. This includes in particular:a.the data protection policy;b.the documentation on objectives and measures relating to the guarantee of data protection and data security;c.the organisational and technical measures for the achievement of the goals and measures laid down, and in particular the measures to rectify any irregularities detected.3 The Commissioner shall issue guidelines on the minimum requirements for the data protection management system. In doing so, he shall take account of the internationally specified requirements relating to the construction, operation, monitoring and improvement of management systems, and as set out in particular in the following technical standards3:SN EN ISO 9001:2000, quality management systems, requirements;SN EN ISO 27001:2005, information technology, IT security procedures, information security management systems, requirements.44 The exemption from the obligation to register data files in accordance with Article 11a paragraph 5 letter f FADP is only applicable if all data processing procedures that apply to a data file are certified.3 The standards mentioned may be inspected and obtained at the Swiss Association for Standardization, Bürglistrasse 29, 8400 Winterthur, www.snv.ch.4 Amended by No I of the Ordinance of 30 Sept. 2016, in force since 1 Nov. 2016  (AS 2016 3447).Art. 5 Certification of products  1 Products may be certified if their primary purpose relates to the processing of personal data or their use results in the generation of personal data, and in particular data on the user.2 The subject matter of the assessment is in particular the guarantee inherent to the product:a.of the confidentiality, integrity, availability and authenticity of the processed personal data taking account of the purpose of the product;b.of the avoidance of the unnecessary generation, storage or other processing of personal data taking account of the purpose of the product;c.of the transparency and comprehensibility of the automated processing of personal data that results from the functionality of the product determined by the manufacturer;d.of technical measures to support the user in complying with data protection requirements and obligations under data protection law.3 The Commissioner shall issue guidelines on which specific data protection criteria must as a minimum be assessed in terms of the product certification procedure.55 Amended by No I of the Ordinance of 12 March 2010, in force since 1 April 2010  (AS 2010 949).Art. 6 Grant and validity of certification  1 The certificate is granted if the certification procedure based on the assessment or checking criteria applied by the certification organisation establishes that the requirements under data protection law as well as the requirements imposed by this Ordinance and the guidelines issued by the Commissioner (Art. 4 para. 3 and 5 para. 3) or any other equivalent standards are fulfilled. Certification may be made subject to conditions or requirements.2 The certification of a data protection management system is valid for three years. The certification organisation must conduct an annual summary review of whether the requirements for certification continue to be fulfilled.3 The certification of a product is valid for two years. A product must be certified again as soon as any fundamental changes are made thereto.Art. 7 Recognition of foreign data protection certification  The Commissioner in consultation with the Swiss Accreditation Service shall recognise foreign certifications provided a guarantee is given that the requirements of the Swiss legislation are fulfilled.Art. 8 Notification of the result of the certification procedure  1 If a certified organisation notifies the Commissioner that it has successfully undergone the certification procedure in accordance with Article 4 in order to be exempted under Article 11a paragraph 5 letter f FADP from the obligation to register its data files, it must submit the following documents on request:a.the assessment report;b.the certification documents.2 If the certification organisation in the course of its monitoring activities detects substantial changes in conditions for certification, for example relating to the fulfilment of conditions or requirements, the certified organisation must notify the Commissioner of this.3 The Commissioner shall publish a list of organisations that have been certified and are relieved of the obligation to register their data files (Art. 28 para. 3 of the Ordinance of 14 June 19936 to the Data Protection Act). In particular, this list provides information on the term of validity of the certification.6 SR 235.11Section 3 Sanctions  Art. 9 Suspension and withdrawal of the certification  1 The certification organisation may suspend or withdraw certification, in particular if it establishes serious irregularities in the course of an inspection (Art. 6 para. 2). A serious irregularity is constituted in particular where:a.essential requirements for data protection certification are no longer fulfilled; orb.a certificate is being used in a misleading or unlawful manner.2 In the event of any dispute in relation to the suspension or the withdrawal, the assessment and the procedure for the case are governed by the provisions of civil law that are applicable to the contractual relationship between the certification organisation and certified organisation.3 The certification organisation shall notify the Commissioner of the suspension or the withdrawal the data protection certification provided the Commissioner has been notified of certification in accordance with Article 8 paragraph 1.Art. 10 Procedure in the case of supervisory measures by the Commissioner  1 If the Commissioner detects serious irregularities in the supervisory activity in accordance with Article 27 or 29 FADP in the case of a certified organisation, he shall notify the certification organisation thereof.2 The certification organisation shall immediately arrange for the certified organisation to rectify the irregularity within 30 days of receipt of notification from the Commissioner.3 If the certified organisation fails to rectify the irregularity within this time, the certification organisation shall suspend the certification. If there is no prospect of the lawful position being established or restored within a reasonable time, certification must be withdrawn.4 If within the period in accordance with paragraph 2, the certified organisation fails to rectify the irregularity and the certification organisation does not suspend or withdraw certification, the Commissioner shall issue a recommendation in accordance with Article 27 paragraph 4 or Article 29 paragraph 3 FADP to the certified organisation or to the certification organisation. He may in particular recommend that the certification organisation suspend or withdraw the certification. If he issues the recommendation to the certification organisation, he must notify the Swiss Accreditation Service.Section 4 Commencement  Art. 11 This Ordinance comes into force on 1 January 2008.Annex7 7 Revised by No II of the Ordinance of 30 Sept. 2016, in force since 1 Nov. 2016  (AS 2016 3447).(Art. 1 para. 5)Minimum Qualification Requirements for Staff at Certification Organisations that conduct Certification Procedures 1 Certification of Data Protection Management Systems  The certification organisation must provide proof that its staff who certify data protection management systems when taken together hold the following qualifications:–knowledge of data protection law: proof is required of a minimum of two years’ practical experience in the field of data protection or a successfully completed course of studies at a university or university of applied sciences of a minimum of one year in duration with data protection law as the main subject;–knowledge of the field of information technology security: proof is required of a minimum of two years’ practical experience in the field of information technology security or a successfully completed course of studies at a university or university of applied sciences of a minimum of one year in duration with information technology security as the main subject;–training as a management systems auditor who meets the internationally specified requirements, in particular as expressed in standard SN EN ISO/IEC 17021-18, conformity assessments, requirements for bodies that audit and certify management systems, Part 1: Requirements.The certification organisation must provide proof that it has qualified staff in each of the individual specialist fields. The assessment of data protection management systems by an interdisciplinary team is permitted.8 The standard mentioned may be inspected and obtained at the Swiss Association for Standardization, Bürglistrasse 29, 8400 Winterthur, www.snv.ch.2 Certification of products  The certification organisation must provide proof that its staff who certify products when taken together hold the following qualifications:–knowledge of data protection law: proof is required of a minimum of two years’ practical experience in the field of data protection or a successfully completed course of studies at a university or university of applied sciences of a minimum of one year in duration with data protection law as the main subject;–knowledge of the field of information technology security: proof is required of a minimum of two years’ practical experience in the field of information technology security or a successfully completed course of studies at a university or university of applied sciences of a minimum of one year in duration with information technology security as the main subject;–specialist knowledge in relation to the product testing that meet the internationally specified requirements, in particular as expressed in standard SN EN ISO/IEC 170659, Conformity assessment, requirements for bodies that certify products, processes and services.The certification organisation must provide proof that it has qualified staff in each of the individual specialist fields. Product testing by an interdisciplinary team is permitted.9 The standard mentioned may be inspected and obtained at the Swiss Association for Standardization, Bürglistrasse 29, 8400 Winterthur, www.snv.ch.