Sub Processing Agreement Template for Switzerland

A Sub Processing Agreement is a critical legal document that governs the relationship between a primary data processor and a sub-processor when personal data processing activities are delegated to third parties. Under Swiss law, this agreement ensures compliance with the Swiss Federal Data Protection Act (FADP) and maintains the integrity of data protection obligations throughout the processing chain.

When do you need this document?

You need a Sub Processing Agreement whenever your organization, acting as a data processor, requires the services of another entity to process personal data on your behalf. This commonly occurs in cloud computing arrangements where you engage hosting providers, when outsourcing customer service operations that involve personal data access, or when using specialized software-as-a-service platforms that process personal information. The agreement is also essential when implementing multi-vendor IT solutions where different suppliers handle various aspects of data processing, or when engaging consultants who require access to personal data to perform their services.

Key legal considerations

The agreement must clearly define the scope of processing activities, specify the categories of personal data involved, and outline the purposes for which data may be processed. Critical clauses include data security measures that meet or exceed your own standards, breach notification procedures with specific timeframes, and audit rights allowing you to verify compliance. The agreement should address data transfer restrictions, particularly for cross-border transfers, and include provisions for data deletion or return upon contract termination. Liability allocation clauses are essential to ensure appropriate risk distribution between parties, while indemnification provisions protect against potential data protection violations. The sub-processor must also commit to engaging only authorized personnel and implementing appropriate technical and organizational measures.

Legal requirements in Switzerland

Under the Swiss Federal Data Protection Act (FADP), sub-processing arrangements must maintain the same level of data protection as the original processing agreement. The sub-processor must provide sufficient guarantees regarding technical and organizational security measures, and any cross-border data transfers must comply with Swiss adequacy requirements or implement appropriate safeguards. If your organization also processes EU personal data, GDPR Article 28 requirements apply, mandating written agreements with specific content requirements and ensuring sub-processors provide sufficient guarantees for GDPR compliance. Swiss law requires that sub-processors be held to the same data protection standards as the primary processor, with clear accountability mechanisms throughout the processing chain. The agreement must also address the Swiss Federal Data Protection Ordinance requirements for data processor relationships and include provisions for regulatory cooperation and assistance with data subject rights.