Appointment letter template for the data protection advisor (DPO)
- Art. 10 FADP
- Art. 24 GDPR
- Art. 37-39 GDPR
- About 20 minutes
- Italiano · Deutsch · Français · English
In brief
The letter by which you appoint the data protection advisor (DPO), internal or external, and set their tasks, independence and resources. You need it if the law requires this role or if you choose to have it.
- Who it is for
- The person appointed and management, who both sign. It stays in the records.
- To decide first
- Whether the person is external to the organisation and from when the appointment takes effect. The advisor's name and contact details come from the organisation's details.
- Afterwards
- Have it signed, state the advisor's contact details in the privacy notices and, where required, communicate them to the authority.
What it contains
- 1Appointment
- 2Tasks
- 3Independence
- 4No conflicts of interest
- 5Expertise
- 6Resources and access to information
- 7Confidentiality
- 8Publication and communication to the authority
- 9Term and end of the appointment
- 10Signatures
An excerpt
1. Appointment
With effect from __________ the organisation designates __________ as data protection advisor within the meaning of Art. 10 FADP and as data protection officer (DPO) within the meaning of Art. 37 GDPR.
The two functions are performed by the same person. In this letter the term "advisor" refers to both.
The advisor is an employee of the organisation and performs the function alongside his or her other duties. The appointment does not amend the employment contract, except as provided in this letter.
The organisation remains the controller and is responsible for compliance with the legislation. The appointment does not transfer this responsibility to the advisor.
2. Tasks
The advisor:
- trains and advises the organisation on data protection matters (Art. 10 para. 2 let. a FADP);
- participates in the application of the data protection provisions (Art. 10 para. 2 let. b FADP);
- is the point of contact for data subjects and for the Federal Data Protection and Information Commissioner (FDPIC);
- reviews data protection impact assessments and gives an opinion on the measures planned;
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| Obligation | Optional for private persons (Art. 10 FADP) | Mandatory in certain cases: large-scale monitoring or sensitive data on a large scale (Art. 37 GDPR) |
| Advantage | With an advisor appointed and notified, there is no need to consult the FDPIC after a data protection impact assessment (Art. 23 para. 4 FADP) | The DPO must be involved in all data protection issues (Art. 38 GDPR) |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Template resolution launching the new FADP compliance programme
- Template for appointing an internal data protection contact
- Internal data protection policy template
Related question: Do I have to appoint a data protection officer (DPO)?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.