The Data Processing Agreement is a mandatory legal document required under Swiss data protection law when a company (data controller) engages another party (data processor) to process personal data on its behalf. This agreement has become increasingly important with the implementation of the new Swiss Federal Act on Data Protection in 2023, which brought Swiss law closer to GDPR standards. The document outlines specific obligations, security measures, and compliance requirements for both parties, ensuring proper handling of personal data and protection of data subjects' rights. It is particularly crucial for international businesses operating in or through Switzerland, as it must address both domestic requirements and potentially international data protection standards. The agreement typically includes detailed technical specifications, security measures, breach notification procedures, and data transfer mechanisms, making it an essential tool for maintaining regulatory compliance and establishing clear accountability in data processing relationships.

1. Parties: Identification of the data controller and data processor, including full legal names, registration details, and addresses

2. Background: Context of the agreement, relationship between parties, and brief description of the data processing activities

3. Definitions: Key terms used in the agreement, including those from FADP and relevant technical terminology

4. Scope and Purpose of Processing: Detailed description of the authorized data processing activities, categories of data subjects, and types of personal data

5. Duration: Term of the agreement, including start date and termination provisions

6. Obligations of the Data Processor: Core responsibilities including processing only on documented instructions, confidentiality, security measures, and subprocessing restrictions

7. Obligations of the Data Controller: Responsibilities including lawful basis for processing, accuracy of data, and providing documented instructions

8. Technical and Organizational Measures: Security requirements and standards to be maintained for data protection

9. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

10. Personal Data Breach: Notification requirements and procedures in case of data breaches

11. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

12. Cross-border Data Transfers: Rules and safeguards for international data transfers

13. Return or Deletion of Data: Obligations regarding data handling upon termination of services

14. Liability and Indemnification: Allocation of responsibilities and financial obligations for breaches

15. General Provisions: Standard contractual terms including governing law, jurisdiction, and amendment procedures