Data protection for private individuals in Switzerland

Art. 14 DPO

Retention of the data protection impact assessment

Chapter 2: Obligations of the Controller

Statutory textStatus: 1 December 2025

The controller must retain the data protection impact assessment after concluding the data processing for a minimum of two years.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

The controller must keep its data protection impact assessment for at least two years after the processing has ended (Art. 22 FADP).

What does this mean for me?

This obligation is aimed at companies and authorities. For you, it means: even after risky processing has ended, it remains possible to trace how the risks to you were assessed.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 22 FADPData protection impact assessment

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.