The revised Federal Act on Data Protection (DSG) has applied together with the Data Protection Ordinance (DSV) since 1 September 2023 (Art. 74 DSG, Art. 47 DSV). Two practical questions arise for SMEs: Must our business keep a record of processing activities, and when do we need a data protection impact assessment (DPIA)? This guide answers both questions on the basis of the statutory text, explains technical and organisational measures as a common foundation and shows with an example how a business proceeds.
The record of processing activities under Art. 12 DSG
Controllers and processors each keep a record of their processing activities (Art. 12, para. 1 DSG). A controller is the party who, alone or jointly with others, decides on the purpose and means of the processing; a processor processes on behalf of the controller (Art. 5 lit. j and k DSG). The controller’s record contains at least (Art. 12, para. 2 DSG):
- the identity of the controller
- the purpose of processing
- the categories of data subjects and the categories of personal data processed
- the categories of recipients
- if possible, the retention period or the criteria for it
- if possible, a general description of the measures to ensure data security under Art. 8 DSG
- in the case of disclosure abroad, the state and the safeguards under Art. 16, para. 2 DSG
The processor’s record is shorter and contains details of its identity and that of the controller, of the categories of processing carried out on behalf of the controller and of the data security measures, as well as of disclosure abroad (Art. 12, para. 3 DSG). For an example of cooperation with external service providers, see the guide Working with fiduciaries. Private companies do not report their record to the Federal Data Protection and Information Commissioner (FDPIC); this duty applies only to federal bodies (Art. 12, para. 4 DSG).
Who is exempt from the duty
Art. 12, para. 5 DSG instructs the Federal Council to provide exceptions for companies that employ fewer than 250 employees and whose data processing poses a low risk. The Data Protection Ordinance (DSV) implements this in Art. 24: companies and other private-law organisations that employ fewer than 250 employees on 1 January of a year, as well as natural persons, are exempt from the duty. The exemption does not apply if one of two conditions is met: particularly sensitive personal data is processed on a large scale, or high-risk profiling is carried out.
Under Art. 5 lit. c DSG, particularly sensitive data includes, for example, data on health, on religious, philosophical, political or trade union views, genetic data, biometric data that uniquely identifies a person, data on administrative and criminal proceedings or sanctions, or data on social assistance measures. The ordinance does not say from what quantity “on a large scale” applies; you have to assess this case by case. The FDPIC describes the duty on its website in substance in the same way; it does, however, state the threshold there as “more than 250 employees”. For the borderline case of exactly 250 employees, the wording of the ordinance applies: only businesses with fewer than 250 are exempt. Even an exempt business must comply with the other provisions, such as the duties to provide information and to inform.
Anyone who processes particularly sensitive data on a large scale or carries out high-risk profiling must also draw up processing regulations for automated processing (Art. 5 DSV). A record is good evidence that you know your data processing even without a duty; this recommendation is practice and not a statutory requirement.
Technical and organisational measures
Controllers and processors must ensure data security appropriate to the risk through suitable technical and organisational measures (Art. 8, para. 1 DSG). The ordinance makes this concrete: first you determine the protection needs of the data and assess the risk; then you set the measures (Art. 1 DSV). Protection needs, risk and measures must be reviewed throughout the period of processing and adjusted if necessary (Art. 1, para. 5 DSV). The measures pursue four goals: confidentiality, availability, integrity and traceability (Art. 2 DSV). Examples from Art. 3 DSV are access and entry control, rapid restoration of the data after an incident, an up-to-date security level of the systems and the ability to check who entered or changed which data.
The data protection impact assessment
The controller carries out a DPIA in advance if processing may entail a high risk to the personality or fundamental rights of the data subject (Art. 22, para. 1 DSG). The high risk arises from the nature, scope, circumstances and purpose of the processing, in particular when new technologies are used. It exists especially in the case of extensive processing of particularly sensitive personal data and systematic monitoring of extensive public areas (Art. 22, para. 2 DSG). Several similar processing operations may be assessed together.
The DPIA contains a description of the planned processing, an assessment of the risks and the protective measures (Art. 22, para. 3 DSG). The FDPIC describes the DPIA as an instrument with which risks are recorded, assessed and dealt with; what matters in the end is the remaining residual risk. Private controllers are exempt if they are legally obliged to carry out the processing (Art. 22, para. 4 DSG); private controllers may also dispense with a DPIA if they use a system, product or service certified for the intended use, or comply with a code of conduct that is based on a DPIA, provides for protective measures and has been submitted to the FDPIC (Art. 22, para. 5 DSG).
If a high risk remains despite the measures, the controller obtains the FDPIC’s opinion in advance (Art. 23, para. 1 DSG). The FDPIC communicates its objections within two months; for complex processing the period can be extended by one month (Art. 23, para. 2 DSG). Private controllers may dispense with the consultation if they have consulted their data protection adviser (Art. 23, para. 4 DSG). This applies only if this person works independently in professional terms and is not bound by instructions, does not perform incompatible activities, has the necessary expertise, and their contact details are published and communicated to the FDPIC (Art. 10, para. 3 DSG). The DPIA must be retained for at least two years after the end of the processing (Art. 14 DSV).
Requests for information and the 30 days
Every person can request information on whether personal data about them is being processed (Art. 25, para. 1 DSG); the information is free of charge (Art. 25, para. 6 DSG, subject to exceptions). Under Art. 18 DSV it must be provided within 30 days of receipt of the request. If the controller cannot meet this deadline, it informs the person and states the period within which the information will follow. Anyone who refuses, restricts or postpones the information must communicate this within the same period.
Practical example: Muster Spitex AG
Muster Spitex AG is a fictitious company with 120 employees on 1 January 2026. It is below the threshold of 250 but processes health data of its clients. Whether this happens “on a large scale” has not been conclusively clarified; the management therefore does not rely on the exemption as a precaution and keeps a record. It covers four processing activities:
| Activity | Data subjects | Data categories | Particularly sensitive | Retention |
|---|---|---|---|---|
| Care documentation | Clients | Master data, care data | yes (health) | under the applicable rules, to be clarified by the business |
| Duty scheduling | Employees | Master data, duty times | no | for as long as the employment relationship lasts |
| Payroll | Employees | Master data, salary data | no | under the statutory periods |
| Applications | Applicants | Application documents | no | three months after completion (internal) |
In autumn 2026 it plans software that estimates the clients’ risk of falls from the care data. This is an automated assessment of health aspects (profiling under Art. 5 lit. f DSG), a new technology and an extensive processing of particularly sensitive data; a DPIA is necessary. With this evaluation at the latest, the business processes particularly sensitive personal data on a large scale: the exemption under Art. 24 DSV lapses, and processing regulations are needed for the automated processing (Art. 5 DSV). Because the evaluation is voluntary, the exception for legally required processing (Art. 22, para. 4 DSG) does not apply. The assessment rates three risks on a scale of 1 to 4 for likelihood and severity. The levels are an operational definition of the example and not a statutory yardstick: low up to 3, medium from 4 to 7, high from 8.
| Risk | Before | Measure | After |
|---|---|---|---|
| Misjudgement leads to unsuitable measures | 2 × 3 = 6 | Forecast only as a pointer, decision of the nursing professional is recorded | 1 × 3 = 3 |
| Unauthorised access to the evaluations | 3 × 3 = 9 | Access by role, logging | 2 × 3 = 6 |
| Manufacturer’s support access from abroad | 2 × 4 = 8 | Access only on request, contractual safeguards under Art. 16, para. 2 DSG | 1 × 4 = 4 |
The highest residual rating is 6, that is medium. The management concludes that no high residual risk within the meaning of Art. 23, para. 1 DSG remains, and records the decision with reasons; the FDPIC’s opinion is therefore not needed. The manufacturer’s support is entered in the record as disclosure abroad with state and safeguard. On Monday, 9 November 2026, a request for information from a client also arrives. The 30-day period runs until Wednesday, 9 December 2026.
Checklist
- Checked whether the exemption under Art. 24 DSV applies (employees on 1 January, particularly sensitive data, profiling)
- Processing activities recorded: purpose, categories, recipients, retention, disclosure abroad
- Data security measures described and reviewed regularly
- Record aligned with processors
- Before new systems, checked whether a DPIA is needed, and the result recorded
- If high residual risk: FDPIC’s opinion obtained or data protection adviser consulted under Art. 10 DSG
- DPIA retained for at least two years after the end of the processing
- Procedure for requests for information with a 30-day period defined
How KMU | base helps
QMS | base manages data protection topics under Operations and records › Data protection. The area is tied to its own right. The software itself points out that periods, thresholds and criteria are QMS | base’s own rules and do not replace a legal assessment in the individual case.
1. Record of processing activities. You keep the record under the DSG with purpose, data categories, recipients, disclosure abroad, retention and review interval, as Excel and PDF. The software reports missing mandatory details. An entry becomes active only once purpose, categories and retention are recorded; for retention it thus asks for more than Art. 12, para. 2 lit. e DSG, which requires this detail only where possible. It does not check automatically whether your business is exempt under Art. 24 DSV.
2. Technical and organisational measures. You maintain your measures with status and review date and link them to the processing activities.
3. Data protection impact assessment. You first check the risk in a preliminary check with criteria, assess risks and measures and, in the case of a high residual risk, see the note to consider consulting the supervisory authority. Approval follows the four-eyes principle. The criteria of the preliminary check and the thresholds of the risk matrix are QMS | base’s own rules; whether a DPIA is required is decided by the controller. The software does not monitor the retention of the DPIA.
4. Data subject requests with deadlines. You record requests for information, rectification and erasure only with a freely chosen short code, without names or contact details, monitor the deadline and are reminded daily. The internal deadline is 30 days from receipt and can be extended with a reason. For information this corresponds to Art. 18 DSV; for the other requests it is a rule of QMS | base.
If you would like to try it yourself, take a look at the demo or open a trial account. You will find current terms under Pricing; if you have questions, the contact page will help.
Sources
- Federal Act on Data Protection (DSG, SR 235.1), Art. 5, 8, 10, 12, 16, 22, 23, 25 and 74, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Data Protection Ordinance (DSV, SR 235.11), Art. 1–3, 5, 14, 18, 24 and 47, as at 1 December 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- FDPIC: FAQ Data protection, section on the processing directory, page without a date, accessed on 27.10.2026.
- FDPIC: Data protection impact assessment, page without a date, accessed on 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27 October 2026.