EasyLPD
Self-assessment

Internal data protection policy template

  • Art. 10 FADP
  • Art. 24 GDPR
  • Art. 7 FADP
  • Art. 25 GDPR
  • About 15 minutes
  • Italiano · Deutsch · Français · English

In brief

The internal rules on data protection: it says which principles your organisation follows and, above all, who does what. The other documents (retention, security, data breaches) refer to it.

Who it is for
All employees. You have them read it and, if you wish, sign that they have done so.
To decide first
Four roles: who the internal contact is, who approves, who answers requests, who handles incidents.
Afterwards
You make it final, have employees read it and move on to the data retention policy.

What it contains

  1. 1Purpose and scope
  2. 2Definitions
  3. 3Principles
  4. 4When processing is lawful
  5. 5Roles and responsibilities
  6. 6Inventory of processing activities
  7. 7Informing individuals
  8. 8Rights of data subjects
  9. 9Security and data protection by design
  10. 10Suppliers
  11. 11Disclosure of data abroad
  12. 12Retention and erasure
  13. 13Risk assessment
  14. 14Automated decisions and artificial intelligence
  15. 15Data security breaches
  16. 16Training
  17. 17Monitoring and non-compliance
  18. 18Review and entry into force

An excerpt

1. Purpose and scope

This policy sets out how __________ processes the personal data of customers, employees, job applicants, suppliers and other persons. It applies to all employees, in whatever capacity, and to all processing, whether on electronic media or on paper.

This policy is the reference document of the data protection programme of __________: it sets the principles and the roles. The other internal rules (data retention, security measures, handling of data security breaches, data subject requests) apply it each in its own area and are to be read together with it.

Groups of data it applies to

The groups of data processed are listed in the inventory of processing activities (section 6).

The legislation of reference is the following.

  • The Federal Act on Data Protection (FADP) and the related Data Protection Ordinance.

The full text is generated on the platform, with your organisation's details already in place.

Related templates

A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.