Templates
39 templates for the new FADP and the GDPR
Privacy notices, contracts, records, procedures and appointments, written from the law in force. Each template says what it is for; on the platform it is filled in with your organisation's details.
Set up
- Template resolution launching the new FADP compliance programmeDecision by which the governing body launches compliance with data protection law, assigns internal roles and sets priorities; to be adopted at the start of the process and kept on file.
- Appointment letter template for the data protection advisor (DPO)Letter by which the organisation designates the data protection advisor (Art. 10 FADP) or the data protection officer (Art. 37 GDPR), internal or external, and sets out the tasks, independence and resources of the function.
- Mandate template for the EU representative (Art. 27 GDPR)Written mandate by which an organisation not established in the European Union designates its representative under Art. 27 GDPR and defines the representative's tasks and limits.
- Template for appointing an internal data protection contactInstrument by which the organisation entrusts a person with a data protection role (internal contact, handling of requests, handling of breaches), with tasks, powers and a deputy.
- Internal data protection policy templateInternal rules by which the organisation sets out principles, roles and procedures for the processing of personal data; it applies to all employees and is the reference document of the data protection programme.
Rules on the data
- Parental consent form template for processing a child's dataForm by which a parent or legal representative consents to the processing of a minor's personal data; to be used when the processing requires consent and the minor cannot give it alone.
- Privacy notice template for customers and contractual partnersNotice to be given to customers and contractual partners when the contract is concluded, with a separate, optional section for marketing consent.
- Image release form template for customers, guests and visitorsForm by which customers, guests and event visitors consent to the use of photographs and videos in which they appear, separately for each communication channel; to be signed before publication.
- Employee image release form templateForm by which employees consent freely, and separately for each channel, to the use of photographs and videos in which they appear in corporate communication; to be signed before any publication.
- Data retention policy template with retention periodsInternal rules on how long personal data are kept and how they are disposed of, with a table of retention periods per category of documents to be completed.
- Parental consent withdrawal form templateForm with which a parent or the legal representative withdraws the consent given for the processing of a minor's data; to be handed over together with the parental consent form.
- Consent withdrawal form templateForm with which a person withdraws consent given previously; to be made available wherever consent is collected.
- Legitimate interest assessment (LIA) templateWorksheet for verifying and documenting, with the three-step test, that processing can be based on the organisation's interest without unduly overriding the rights of individuals.
Inform people
- Email confidentiality notice templateShort text to be added at the foot of business e-mails, with the confidentiality notice and a reference to the privacy notice.
- Cookie policy template for Swiss and European websitesNotice on the cookies and similar technologies used by the website, with the categories, how to accept or refuse them and the browser settings.
- App privacy notice templateNotice to be published in the mobile app and on its app store page; it explains which data the app collects, which device permissions it uses and what rights users have.
- Job applicant privacy notice templateNotice for people applying for a job; it explains how application data are processed, how long they are kept and on what conditions they remain in a talent pool.
- Employee privacy notice templateNotice to be given to employees on recruitment; it explains which data the employer processes in the employment relationship, why, for how long and with what rights.
- Website privacy notice template (FADP and GDPR)Notice to be published on the website; it explains to visitors which data are collected, why, to whom they are disclosed and what rights they have.
- Video surveillance notice and sign templateShort text for the sign to be displayed at the entrance to areas under video surveillance and full notice to be kept available for visitors, customers and employees.
- Company policy template on the use of artificial intelligenceRules for employees on the use of artificial intelligence tools, with a list of approved tools, data that must not be entered, human review of the results and an inventory of use cases.
Protect and delegate
- Template for notifying data subjects of a data security breachTemplate letter for informing, in plain language, the persons whose data have been affected by a security breach.
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)Agreement to be signed with every provider that processes personal data on behalf of the organisation (hosting, cloud, payroll, newsletter, IT support), with annexes on the processing, security measures and sub-processors.
- Employee confidentiality undertaking and instructions templateDeclaration by which an employee with access to personal data undertakes to keep them confidential and receives the instructions for processing them; to be signed on recruitment or at the start of the assignment.
- Technical and organisational security measures (TOMs) templateDescription of the technical and organisational measures by which the organisation protects personal data, with tables to be completed on status and notes; it serves as evidence of security and as an annex to contracts.
- Internal form template for reporting a data security breachInternal form with which every employee immediately reports a breach, even a merely suspected one, of the security of personal data.
- Template for notifying a data security breach to the authorityTemplate for notifying a data security breach to the data protection authority, with all the information required by law.
- BYOD policy template on the use of private devices at workRules for employees who use private smartphones, tablets or computers for work, with security requirements, separation of data, limits on company checks and a declaration of acceptance.
- Data security breach procedure template (data breach)Internal procedure setting out who does what when personal data are lost, stolen, altered or made accessible to unauthorised persons, from discovery to notification and closure of the case.
- Data security breach register templateRegister in which to document every data security breach, whether notified or not, with the facts, the consequences, the measures taken and the decisions made.
- Rules template on the use of company IT toolsRules for employees on the use of computers, email, the internet and cloud services, with the limits on monitoring by the employer and the duty to report incidents.
- Data protection impact assessment (DPIA) templateTemplate for assessing, before starting processing that may entail a high risk, the risks to individuals and the measures to reduce them, and for documenting the decision.
- Data security breach risk assessment templateWorksheet for assessing the risk that a breach entails for the persons affected and for documenting the decision whether or not to notify the authority and the data subjects.
- Template for assessing a transfer of data abroad (TIA)Worksheet for documenting and assessing a transfer of personal data to a country without adequate protection, from the basis of the transfer to the supplementary measures and the conclusion.
Respond and maintain
- Employee data protection training programme templateProgramme of data protection training sessions for employees, with topics, target groups, assessment of learning and attendance register.
- Personal data access request form templateForm by which a person asks whether personal data about them are processed and which ones, and to receive a copy; to be published on the website or given to anyone who asks for it.
- Request form template for erasure, rectification or objectionForm by which a person requests the deletion of their personal data or, alternatively, their rectification, or objects to processing; to be published on the website or given to anyone who asks for it.
- Procedure template for handling data subject requestsInternal procedure setting out how to receive, verify, process and document the requests by which individuals exercise their rights (access, rectification, erasure, objection, portability, automated decisions).
- Response templates for data subject requestsCollection of letters ready to be adapted and sent to persons exercising their rights (acknowledgement of receipt, identity verification, reply to an access request, confirmation of erasure, reasoned refusal, extension of the time limit).
How it works
- Choose the template: the page says what it is for and what to decide first.
- On the platform, answer the template's questions: name, contacts and applicable laws are already filled in.
- Edit the text, make it final and download it as Word or PDF, or have it signed.
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting.