Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Art. 9 FADP
- Art. 28 GDPR
- About 40 minutes
- Italiano · Deutsch · Français · English
In brief
The agreement you sign with every supplier that processes personal data on your behalf, for example for hosting or payroll. It sets what the supplier may do with the data, how it protects them and what happens at the end.
- Who it is for
- The supplier. You both sign it; it applies together with the service contract.
- To decide first
- Who the supplier is and what service it provides; in the three annexes you describe the data entrusted, the security measures and the authorised sub-processors.
- Afterwards
- Have the supplier sign it, upload the signed copy and link it to the supplier's entry in the list of vendors.
What it contains
- 1Recitals
- 2Subject matter and definitions
- 3Instructions of the Controller
- 4Confidentiality
- 5Data security
- 6Sub-processors
- 7Place of processing and transfers abroad
- 8Assistance to the Controller
- 9Data security breaches
- 10Checks and audits
- 11Return and deletion of the data
- 12Liability
- 13Term and termination
- 14Final provisions
- 15Signatures
- 16Annex 1 – Description of the processing
- 17Annex 2 – Technical and organisational measures
- 18Annex 3 – Authorised sub-processors
An excerpt
Recitals
The Processor provides the Controller with the following service (hereinafter the "Main Agreement"): __________.
In order to provide the service, the Processor processes personal data on behalf of the Controller. The Controller determines the purposes and means of the processing; the Processor acts only on the Controller's behalf.
This agreement governs processing by a processor within the meaning of Art. 9 of the Swiss Federal Act on Data Protection (FADP).
This agreement contains the elements required by Art. 28(3) of Regulation (EU) 2016/679 (GDPR).
1. Subject matter and definitions
1.1 The agreement sets out the obligations of the Parties for the processing of personal data that the Processor carries out on behalf of the Controller. The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| Form | Contract or law; the FADP prescribes no minimum content (Art. 9 para. 1) | Contract or other legal act, in writing, including in electronic form (Art. 28(3) and (9)) |
| Content | The processor processes the data only as the controller itself would be permitted to and ensures its security (Art. 9 paras. 1-2) | Mandatory list: subject matter, duration, nature, purpose, types of data, instructions, confidentiality, security, assistance, deletion, audits (Art. 28(3)) |
| Sub-processors | Only with the prior authorisation of the controller (Art. 9 para. 3) | Written authorisation, specific or general with a right to object (Art. 28(2) and (4)) |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Employee confidentiality undertaking and instructions template
- Technical and organisational security measures (TOMs) template
- BYOD policy template on the use of private devices at work
Related question: Do we need a contract with vendors that process data for us?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.