1 Private controllers may appoint a data protection officer.
2 The data protection officer is the contact point for the data subjects and for the authorities responsible for data protection in Switzerland. He or she has the following tasks in particular:
- a.
training and advising the private controller in matters of data protection;
- b.
providing support on applying the data protection regulations.
3 Private controllers may invoke the exception in Article 23 paragraph 4 if the following requirements are satisfied:
- a.
The data protection officer exercises his or her function towards the controller in a professionally independent manner and is not bound by any instructions.
- b.
He or she does not carry out any activities that are incompatible with his or her tasks as a data protection officer.
- c.
He or she has the required expertise.
- d.
The controller publishes the contact details of the data protection officer and notifies the FDPIC thereof.
4 The Federal Council shall regulate the appointment of data protection officers by federal bodies.