What is profiling, and when is it high-risk?
By Advisorn · updated on 25 October 2026 · Art. 5 let. f and g, 6 para. 7, 21, 22 FADP, Art. 24 Data Protection Ordinance, Art. 4 no. 4 and 22 GDPR
In short
Profiling is the automated processing of personal data to evaluate aspects of a person, such as performance at work, economic situation, health, preferences or movements (Art. 5 let. f FADP). It is high-risk profiling when it combines data in a way that allows an assessment of essential aspects of the personality (Art. 5 let. g FADP): then consent, if needed, must be explicit (Art. 6 para. 7 let. b FADP).
Examples
- a creditworthiness score calculated from many data about a person;
- customer segmentation for personalised offers, if it combines purchases, browsing and demographic data;
- a system that assesses job applicants or employees' performance.
What it entails
High-risk profiling removes the exemption from the record below 250 employees (Art. 24 Data Protection Ordinance), often requires an impact assessment (Art. 22 FADP) and stronger security measures. If it leads to a decision taken solely by the machine, the person must be informed (Art. 21 FADP).
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.