Is a record of processing activities required under the new FADP?

By Advisorn · updated on 17 October 2026 · Art. 12 FADP, Art. 24 Data Protection Ordinance, Art. 30 GDPR

In short

Yes, as a rule. The FADP requires controllers and processors to keep a record of their processing activities (Art. 12 FADP). Businesses with fewer than 250 employees are exempt, unless they process sensitive personal data on a large scale or carry out high-risk profiling (Art. 24 Data Protection Ordinance).

What it must contain

For each processing activity, at least (Art. 12 para. 2 FADP):

the identity of the controller;
the purpose of the processing;
the categories of data subjects and of personal data;
the categories of recipients;
the retention period, or the criteria for determining it;
a general description of the data security measures;
if the data is disclosed abroad, the State and the safeguards (Art. 16 FADP).

If the business has fewer than 250 employees

The FADP exemption applies only if the risk is low. If the GDPR applies too, its exemption (Art. 30 para. 5 GDPR) is narrower: it does not cover processing that is not occasional, such as managing staff or customers. In practice almost every business that works with the EU keeps the record anyway.

Even an exempt business does well to keep one: it is needed to write the privacy notice, answer a request for access and assess a data breach.

FADP and GDPR compared

	FADP (Switzerland)	GDPR (EU)
Who keeps it	Controller and processor (Art. 12 para. 1)	Controller and processor (Art. 30 para. 1 and 2)
Exemption	Fewer than 250 employees and low risk (Art. 24 Data Protection Ordinance)	Fewer than 250 employees, only for occasional, low-risk processing (Art. 30 para. 5)
In practice	Many SMEs are exempt, but keeping one pays off	Almost always mandatory

What it must contain

If the business has fewer than 250 employees

FADP and GDPR compared

Related questions