Data protection glossary

Adequate protection

Also called: AdequacyThe finding, by the Federal Council (for the FADP) or the European Commission (for the GDPR), that a State protects data adequately: data may go to that State without further safeguards.Art. 16 para. 1 FADP, Annex 1 Data Protection Ordinance, Art. 45 GDPRRead more

Anonymisation

Making data such that it no longer allows, with reasonable means, a person to be identified. Anonymous data is no longer personal data.Art. 6 para. 4 FADP, Recital 26 GDPRRead more

Automated individual decision

A decision based exclusively on automated processing that has a legal consequence for a person or significantly affects them. The person must be informed and may ask for the decision to be reviewed by a natural person.Art. 21 FADP, Art. 22 GDPRRead more

Breach of data security

Also called: Data breachA breach of security that leads to the accidental or unlawful loss, deletion, destruction or modification of personal data, or to its disclosure or being made accessible to unauthorised persons.Art. 5 let. h and 24 FADP, Art. 4 no. 12 and 33-34 GDPRRead more

Breach of privacy

A processing that breaches the principles of the law, takes place against the express will of the person or discloses sensitive personal data to third parties. It is unlawful unless there is a ground for justification.Art. 30 FADPRead more

Certification

The voluntary assessment of systems, products, services or organisations by an accredited body. For a system, product or service that is certified and used for its intended use, it removes the duty to carry out a data protection impact assessment.Art. 13 and 22 para. 5 FADP, Art. 42 GDPRRead more

Code of conduct

Rules drawn up by professional or trade associations, which may be submitted to the FDPIC for an opinion. Whoever complies with a code that is based on a data protection impact assessment, provides for protective measures and has been submitted to the FDPIC is exempt from their own impact assessment.Art. 11 and 22 para. 5 FADP, Art. 40-41 GDPR

Consent

An expression of will given freely, for one or more specific processing operations and after adequate information. It must be explicit for sensitive personal data and high-risk profiling.Art. 6 para. 6-7 FADP, Art. 4 no. 11 and 7 GDPRRead more

Controller

The private person or federal body that, alone or jointly with others, determines the purpose and the means of the processing. For the data of its own customers and employees it is as a rule the business itself.Art. 5 let. j FADP, Art. 4 no. 7 GDPR

Data Privacy Framework

Also called: Swiss-U.S. DPFThe framework under which US companies self-certify with the US Department of Commerce. Since 15 September 2024 data may go without further safeguards to companies certified for Switzerland too.Art. 16 para. 1 FADP, Annex 1 Data Protection OrdinanceRead more

Data protection advisor

Also called: Data protection officer (GDPR), DPOThe internal or external person who advises the business and monitors compliance with the law, independently. Under the FADP it is optional for private persons; under the GDPR it is mandatory in some cases.Art. 10 FADP, Art. 37-39 GDPRRead more

Data protection by design and by default

Also called: Privacy by design, privacy by defaultThe duty to set up a processing, from the planning stage, so that it complies with the law, and to configure systems so that they process only the minimum necessary, unless the person decides otherwise.Art. 7 FADP, Art. 25 GDPRRead more

Data protection impact assessment

Also called: DPIA, DSFAThe prior analysis of a processing that may result in a high risk: description, assessment of the risks and measures. If the risk remains high, the FDPIC must be consulted.Art. 22-23 FADP, Art. 35-36 GDPRRead more

Data subject

The natural person whose personal data is processed: a customer, an employee, a job applicant, a visitor to the website.Art. 5 let. b FADP, Art. 4 no. 1 GDPR

Disclosure

Transmitting personal data or making it accessible, for example by sending it to a vendor or by publishing it.Art. 5 let. e FADP

Duty to provide information

Also called: Privacy notice, privacy policy, data protection statementThe duty to inform people when their data is collected: who the controller is, the purpose, the recipients and the States abroad to which the data goes.Art. 19-21 FADP, Art. 13-14 GDPRRead more

FDPIC

Also called: Federal Data Protection and Information Commissioner, EDÖB, PFPDT, IFPDTThe federal authority that supervises the application of the FADP by private persons and federal bodies. It conducts investigations and can order measures, but it does not impose fines.Art. 43-58 FADPRead more

Ground for justification

What makes lawful a processing that breaches privacy: the consent of the person, an overriding private or public interest, or the law.Art. 31 FADPRead more

High-risk profiling

Profiling that poses a high risk to the personality or fundamental rights of the data subject, because it combines data in a way that allows an assessment of essential aspects of the personality. It does not exist in the GDPR.Art. 5 let. g and 6 para. 7 let. b FADPRead more

Joint controllers

Two or more controllers that jointly determine the purpose and the means of a processing. The GDPR requires an arrangement that sets out their respective responsibilities.Art. 5 let. j FADP, Art. 26 GDPRRead more

Legal basis

In the GDPR, one of the six grounds that make every processing lawful: consent, contract, legal obligation, vital interests, public interest, legitimate interest. The FADP does not require one for every processing.Art. 6 GDPR, Art. 6 and 31 FADPRead more

Personal data

Any information relating to an identified or identifiable natural person. Since 1 September 2023 the FADP no longer protects the data of legal entities.Art. 5 let. a FADP, Art. 4 no. 1 GDPRRead more

Principle of proportionality

Also called: Data minimisationOnly the data needed for the purpose is processed, in the way and for the time needed. Data no longer needed must be destroyed or anonymised.Art. 6 para. 2 and 4 FADP, Art. 5 para. 1 let. c and e GDPRRead more

Processing

Any handling of personal data, irrespective of the means and procedures used: collecting, recording, storing, using, modifying, disclosing, archiving, deleting or destroying.Art. 5 let. d FADP, Art. 4 no. 2 GDPR

Processor

Also called: Vendor that processes data for youThe private person or federal body that processes personal data on behalf of the controller and on its instructions: the cloud service, the fiduciary that runs the payroll, the agency that sends the newsletter.Art. 5 let. k and 9 FADP, Art. 4 no. 8 and 28 GDPRRead more

Profiling

Any automated processing of personal data to evaluate aspects of a person, in particular performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.Art. 5 let. f FADP, Art. 4 no. 4 GDPRRead more

Pseudonymisation

Replacing names and identifiers with a code, keeping the key separate. For whoever holds the key the data remains personal; it is a security measure.Art. 4 no. 5 GDPRRead more

Purpose limitation

Data is collected for a specific purpose that the person can recognise, and is then processed only in a way compatible with that purpose.Art. 6 para. 3 FADP, Art. 5 para. 1 let. b GDPR

Record of processing activities

Also called: Processing registerThe list of activities involving personal data, with at least the purpose, the categories of data subjects and of data, the recipients, the retention period, the security measures and the transfers abroad.Art. 12 FADP, Art. 24 Data Protection Ordinance, Art. 30 GDPRRead more

Representative in Switzerland

The point of contact in Switzerland that some controllers based abroad must designate when they process data of people in Switzerland. The GDPR has a similar role, the representative in the EU.Art. 14-15 FADP, Art. 27 GDPRRead more

Right of access

The right of any person to know whether a controller processes data about them and to receive a copy with the main information, as a rule free of charge and within 30 days.Art. 25-26 FADP, Art. 16-19 Data Protection Ordinance, Art. 15 GDPRRead more

Right to data portability

The right to receive, in a commonly used electronic format, the data one has disclosed to a controller, or to have it transmitted to another, when it is processed automatically with consent or for a contract.Art. 28-29 FADP, Art. 20 GDPRRead more

Sensitive personal data

Also called: Special categories of personal data (GDPR), sensitive dataData on religious, ideological, political or trade union views or activities; health, the private sphere, racial or ethnic origin; genetic data; biometric data that uniquely identifies a person; administrative and criminal proceedings and sanctions; social assistance measures.Art. 5 let. c FADP, Art. 9-10 GDPRRead more

Standard contractual clauses

Also called: SCCA standard contract in which the recipient abroad undertakes to protect the data, used to transfer it to a State without adequate protection. The FDPIC recognises those of the European Commission with the adjustments for Switzerland.Art. 16 para. 2 let. d FADP, Art. 46 GDPRRead more

Sub-processor

Also called: Sub-contractorA third party to which the processor in turn assigns part of the processing. It is allowed only with the prior authorisation of the controller.Art. 9 para. 3 FADP, Art. 28 para. 2 and 4 GDPRRead more

Technical and organisational measures

Also called: TOMsThe measures by which controller and processor ensure data security appropriate to the risk: confidentiality, availability, integrity and traceability.Art. 8 FADP, Art. 1-6 Data Protection Ordinance, Art. 32 GDPRRead more

Definitions summarised from the text of the law, not advice: for your case the text of the law prevails.