Data Processor Privacy Notice Template for Switzerland

When your organization processes personal data on behalf of other companies or entities, you need a comprehensive Data Processor Privacy Notice to comply with Swiss data protection law. This document establishes transparency about your processing activities and demonstrates compliance with the Swiss Federal Data Protection Act (FADP/DSG), which governs how personal data must be handled when you act as a processor rather than the primary data controller.

When do you need this document?

You need a Data Processor Privacy Notice whenever your organization processes personal data according to instructions from data controllers. This commonly occurs in cloud computing services, payroll processing, IT support services, marketing agencies handling client data, or any outsourced business process involving personal information. The notice becomes essential when signing data processing agreements with clients, responding to data subject inquiries, or demonstrating compliance during regulatory audits. You also need this document when processing data for multiple controllers simultaneously or when engaging sub-processors to handle data on your behalf.

Key legal considerations

Your privacy notice must clearly define your role as a data processor and distinguish it from data controller responsibilities. The document should specify the categories of personal data you process, the purposes of processing as instructed by controllers, and the technical and organizational security measures you implement. You must address data retention periods, procedures for data deletion or return upon contract termination, and your policies for engaging sub-processors. The notice should explain how you handle data subject rights requests, including access, rectification, erasure, and data portability rights. International data transfer provisions are crucial if you transfer data outside Switzerland, requiring adequate protection measures or appropriate safeguards. You must also include contact information for your Data Protection Officer if appointed, and procedures for data breach notification to controllers and potentially to the Swiss Federal Data Protection and Information Commissioner.

Legal requirements in Switzerland

Under the revised Swiss FADP, data processors must implement appropriate technical and organizational measures to ensure data security and demonstrate compliance through documentation. You must process personal data only according to documented instructions from the data controller and notify them immediately of any data breaches that pose risks to data subjects. Swiss law requires that your processing activities be governed by a written contract or legal act that specifies the subject matter, duration, nature, and purpose of processing. You cannot engage sub-processors without prior written authorization from the data controller, and you must ensure sub-processors provide the same level of protection. The notice must be available in the official languages relevant to your operations and accessible to data subjects whose information you process. Regular updates to the notice are required when processing activities change significantly or when legal requirements evolve.