Data protection for private individuals in Switzerland

Art. 5 DPO

Processing regulations for private persons

Chapter 1: General ProvisionsSection 1: Data Security

Statutory textStatus: 1 December 2025

1 The private controller and its private processor must issue regulations on automated processing if they:

  • a.

    process a large volume of sensitive personal data; or

  • b.

    carry out high-risk profiling.

2 The regulations must in particular include details of the internal organisational structure, data processing and control procedures and the measures that guarantee data security.

3 The private controller and its private processor must update the regulations regularly. If a data protection officer has been appointed, the regulations must be made available to the officer.

Source: Version on FedlexThis translation is not an official version. Only the German, French and Italian versions are legally binding.

In brief

Private controllers, such as companies, and their processors must issue regulations on automated processing if they process a large volume of sensitive personal data or carry out high-risk profiling. The regulations describe the internal organisation, the processing and control procedures and the data security measures, and must be updated regularly.

What does this mean for me?

This obligation is aimed at companies. For you, it means: anyone processing sensitive data on a large scale must have set down in writing how they go about it and how they check it.

Implements these provisions of the Federal Act on Data Protection (FADP)

  1. Art. 8 FADPData security

Explanation by mydatenschutz.ch in plain language – not legal advice. The statutory text is authoritative.