Joint Controller Data Processing Agreement Template for Switzerland

When your organization collaborates with other entities to process personal data, you need a Joint Controller Data Processing Agreement to comply with Swiss data protection laws. This legal document establishes clear responsibilities between parties who jointly determine how and why personal data is processed, ensuring compliance with the Swiss Federal Data Protection Act (FADP) and related regulations.

When do you need this document?

You need this agreement when your organization shares decision-making authority over personal data processing with another entity. Common scenarios include joint marketing campaigns where multiple companies collect and use customer data, research collaborations between universities and corporations that involve participant data, healthcare partnerships where patient information is shared between providers, and technology platforms where multiple organizations access the same user database. The agreement becomes essential when both parties have a say in determining the purposes of data processing and the means used to achieve those purposes, rather than one party simply processing data on behalf of another.

Key legal considerations

The agreement must clearly allocate responsibilities between joint controllers to avoid regulatory violations and liability disputes. Key provisions include defining each party's role in obtaining valid consent from data subjects, establishing procedures for handling data subject requests such as access, correction, and deletion rights, and creating protocols for data breach notification to both authorities and affected individuals. The document should specify which party serves as the primary contact point for data subjects and regulatory authorities, detail data security measures each controller must implement, and establish liability allocation mechanisms for potential damages or regulatory fines. Cross-border data transfer provisions are crucial if either party processes data outside Switzerland, requiring appropriate safeguards under both Swiss law and potentially the EU GDPR.

Legal requirements in Switzerland

Under the Swiss Federal Data Protection Act (FADP), joint controllers must have a written agreement that transparently allocates their respective responsibilities, particularly regarding data subject rights fulfillment. The agreement must comply with the principle of data minimization, ensuring processing is limited to what is necessary for the stated purposes. Swiss law requires that data subjects can exercise their rights against each controller independently, so your agreement must establish clear procedures for handling such requests. The document must address data retention periods, deletion procedures, and cross-border transfer mechanisms if applicable. Additionally, if your joint processing activities involve EU residents' data, you may need to comply with GDPR requirements, including appointing data protection officers where required and implementing privacy by design principles. The agreement should also consider Swiss Code of Obligations provisions regarding contract formation, performance, and liability between the parties.