1 The responsible federal body and its processor must issue processing regulations for automated processing if they:
- a.
process sensitive personal data;
- b.
carry out profiling;
- c.
process personal data in accordance with Article 34 paragraph 2 letter c FADP;
- d.
allow cantons, foreign authorities, international organisations or private persons access to personal data;
- e.
link data collections with each other; or
- f.
operate an information system or manage data collections with other federal authorities.
2 The regulations must in particular include details of the internal organisational structure, data processing and control procedures, and the measures that guarantee data security.
3 The responsible federal body and its processor must update the regulations regularly and make them available to the data protection officer.