Technical and organisational security measures (TOMs) template
- Art. 8 FADP
- Art. 1-6 Data Protection Ordinance
- Art. 32 GDPR
- About 60 minutes
- Italiano · Deutsch · Français · English
In brief
Describes how you protect personal data: access, encryption, backups, premises, suppliers. It is the evidence of your security and is attached to contracts with customers and suppliers who ask for it.
- Who it is for
- Internal use: management and whoever looks after IT. On request it is given to customers or authorities.
- To decide first
- For each measure in the tables you state its status and a note; at the end you list the measures still to be implemented, with who is in charge and the deadline.
- Afterwards
- Have management approve it, schedule the missing measures and review it periodically.
What it contains
- 1Purpose
- 2How to complete the tables
- 3Organisation and responsibilities
- 4Access control
- 5Encryption and protection of communications
- 6System protection and updates
- 7Backups and continuity
- 8Logging of activities
- 9Physical security
- 10Minimisation, retention and data protection by design
- 11Providers
- 12Incident management
- 13Verification and review
- 14Measures to be implemented
- 15Approval
An excerpt
1. Purpose
This document describes the technical and organisational measures by which __________ protects the personal data it processes. It serves three purposes: checking that the measures are adequate, demonstrating this on request, and identifying what remains to be done.
The FADP requires data security appropriate to the risk to be ensured (Art. 8 FADP). The Data Protection Ordinance specifies the objectives to be achieved: confidentiality, availability, integrity and traceability (Art. 1-3 of the Ordinance). Anyone who intentionally fails to comply with the minimum security requirements is liable to a penalty (Art. 61 let. c FADP).
The GDPR requires measures appropriate to the risk, taking into account the state of the art and the costs of implementation (Art. 32 GDPR), and the ability to demonstrate them (Art. 5(2) and Art. 24 GDPR).
The full text is generated on the platform, with your organisation's details already in place.
Related templates
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.