Controller To Controller Data Processing Agreement Template for Switzerland

When your organization needs to share personal data with another company in Switzerland, where both parties will independently control how that data is processed, you need a Controller To Controller Data Processing Agreement. This specialized contract ensures compliance with Swiss data protection laws while protecting both organizations from regulatory and legal risks associated with shared data processing activities.

When do you need this document?

You'll need this agreement when establishing business partnerships, joint ventures, or collaborative projects where personal data flows between organizations. Common scenarios include mergers and acquisitions where due diligence requires data sharing, research collaborations between universities and corporations, marketing partnerships involving customer data exchange, and strategic alliances where operational data must be shared. The agreement is also essential when Swiss companies work with international partners, particularly those in the EU, as it ensures compliance with both Swiss FADP requirements and potential GDPR obligations for cross-border data transfers.

Key legal considerations

Your agreement must clearly define each party's role as independent data controllers and specify the categories of personal data being shared, processing purposes, and retention periods. Critical clauses should address data security measures, including technical and organizational safeguards that both parties must implement. You'll need provisions covering data subject rights, including how individuals can exercise access, rectification, and deletion rights across both organizations. The agreement should establish clear breach notification procedures, ensuring both parties can meet the 72-hour notification requirement under Swiss law. Include liability allocation clauses to protect against regulatory fines and civil claims, and ensure termination provisions address data return or destruction obligations.

Legal requirements in Switzerland

Under the Swiss Federal Act on Data Protection (FADP/nFADP 2022), your agreement must demonstrate lawful basis for data processing and ensure adequate protection levels for shared personal data. The contract must comply with Swiss Code of Obligations requirements for contract validity and enforceability. When transferring data internationally, you'll need to verify adequate protection levels in destination countries or implement appropriate safeguards like standard contractual clauses. Your agreement should address data localization requirements and specify whether data will be stored within Switzerland or transferred abroad. For organizations dealing with EU data subjects, consider GDPR compliance requirements alongside Swiss law. The Federal Ordinance to the FADP provides detailed implementation guidelines that your agreement should reflect, particularly regarding data security standards and individual rights procedures.