Practical knowledge for Swiss SMEs
Data protection
Guides for “Data protection” in : step by step, with the place in the menu, the steps and the limits.
Data protection
Data protection (overview)
QMS | base › Data protection
Shows tiles with counters for data protection management under the FADP: active processing activities, data security measures, open impact assessments, open data subject requests with deadline and deletion reviews due. It also links to data breaches in the incident register and to assets with personal data.
Step by step
- Click a tile to open the list.
- Red notes on the tiles show overdue requests or reviews that are due.
- At the bottom, download the record as a spreadsheet or PDF.
Record of processing activities
QMS | base › Data protection › Record
Lists the processing activities (Art. 12 FADP) with number VT-001, controller company, status and next review. Filters by status, sensitive personal data and disclosure abroad, search by name or purpose, export as a spreadsheet (XLSX) and as a PDF.
Step by step
- At the bottom, open “Add processing activity”.
- Enter the name, purpose, categories of data subjects and personal data (one entry per line), recipients and retention.
- For disclosure abroad, choose the countries and the safeguard.
- Link data security measures, processes and assets and choose “Create”.
- Download the current state with “Export as spreadsheet” or “Record as PDF”.
Processing activity
QMS | base › Data protection › Record › Entry
Shows a processing activity with all details, the list of missing required fields, the status, the periodic review, the deletion period with deletion reviews, and the impact assessments and requests that concern it.
Step by step
- Under “Completeness and status”, check missing required fields and put the activity into effect with “Activate”.
- Under “Periodic review”, set the next review according to the interval with “Confirm review”.
- Under “Deletion reviews”, record the result of the deletion review.
- Under “Data protection impact assessments”, create a new impact assessment.
- At the bottom, in the “Edit” section, change the details.
Technical and organisational measures (TOMs)
QMS | base › Data protection › TOMs
Catalogue of data security measures (FADP Art. 8, DPO Art. 1 to 5) with number TOM-001, category, status planned, implemented or reviewed and review date. Filter by category.
Step by step
- At the bottom, open “Add measure”.
- Enter the name, category, status and description.
- Optionally link it to processing activities straight away and choose “Create”.
Data security measure
QMS | base › Data protection › TOMs › Entry
Shows a measure with description, status, last and next review and the linked processing activities and impact assessments.
Step by step
- In the “Edit” section, update the status, review date and next review.
- Choose “Save”.
Data protection impact assessments
QMS | base › Data protection › DPIA
Lists the impact assessments (FADP Art. 22) with number DSFA-001, processing activity, result of the preliminary check, overall residual risk and status. New impact assessments are created for a processing activity.
Step by step
- At the bottom, open “Create impact assessment”.
- Choose the processing activity, optionally enter a title and create it.
- Narrow down with the filter to draft, for approval or approved.
Edit and approve an impact assessment
QMS | base › Data protection › DPIA › Entry
Guides you through an impact assessment: preliminary check with criteria, description, risks with likelihood and severity each from 1 to 4 and residual values, actions, decision on consulting the FDPIC for high residual risk (FADP Art. 23), completion and approval by a second person.
Step by step
- In the “Edit” section, tick the applicable criteria of the preliminary check and describe the processing.
- Under “Risks”, record risks with “Add risk” and set the residual values after the measures.
- Under “Actions”, create open points with responsibility and due date.
- Choose “Complete and submit for approval”.
- A second person opens the impact assessment and chooses “Approve” or “Back to draft” with a reason.
Data subject requests
QMS | base › Data protection › Requests
Records requests for access, rectification, erasure, data delivery or objection (FADP Art. 25 to 28 and 32) with number BG-YYYY-NNN and shows the deadline with a traffic light. Only a freely chosen short reference is stored, no personal data of the requesting person.
Step by step
- At the bottom, open “Add request”.
- Choose the type, short reference, date of receipt and responsible person.
- Optionally choose the processing activities concerned and confirm with “Add request”.
- Narrow down by status with the filter; open requests are at the top, sorted by deadline.
Handle a data subject request
QMS | base › Data protection › Requests › Entry
Shows a request with receipt, deadline, extension, identity check and date of the answer. This is where the status, extension and details are updated.
Step by step
- After checking the identity, tick the box in the “Edit” section and save.
- Under “Status”, choose answered or refused with the date of the answer and then “Save status”.
- If needed, enter a new deadline with a reason under “Extend deadline”.
Deletion periods
QMS | base › Data protection › Deletion periods
Shows for each current processing activity the deletion period (months or years from an event) and the last and next deletion review with a due-date traffic light. Deletion reviews can be recorded directly in the row.
Step by step
- In the row, open “Record deletion review”.
- Enter the date, the result deleted or retained and, if retained, the reason.
- Choose “Save review”; the next deletion review follows according to the interval of the processing activity.
The next step starts with a conversation.