EasyLPD
Self-assessment

Do I need a record of processing activities? Free Swiss FADP and GDPR check

The FADP exempts many SMEs from the record of processing activities, the GDPR hardly any. Answer the questions: the answer appears at once, with the articles.

Your answers stay in your browser: nothing is sent or stored.

Does the company have 250 or more employees?

Count the people who work for you at the beginning of the year, part-time included. Natural persons, such as a self-employed person, are exempt under the FADP anyway (Art. 24 Data Protection Ordinance).

Do you process sensitive personal data on a large scale?

Health, religion, political opinions, genetic or biometric data, criminal proceedings, social assistance, for many people: for example a medical practice, a social welfare institution, a recruitment agency.

Do you carry out high-risk profiling?

Automated assessments that combine data in a way that reveals essential aspects of a person's personality, such as a creditworthiness score or a detailed customer profile.

Does the GDPR apply too?

Yes if you have an establishment in the EU, offer goods or services to people in the EU or monitor their behaviour. Not sure? The free self-assessment tells you.

The answer

Answer the questions to see the answer.

What the law says

The FADP requires controllers and processors to keep a record of their processing activities (Art. 12 FADP). The Data Protection Ordinance exempts companies with fewer than 250 employees, unless they process sensitive personal data on a large scale or carry out high-risk profiling (Art. 24 Data Protection Ordinance).

The GDPR has a similar but narrower rule: the exemption for organisations with fewer than 250 employees does not apply if the processing is likely to result in a risk, is not occasional or includes special categories of data or criminal data (Art. 30 para. 5 GDPR). In practice almost every company within the scope of the GDPR keeps the record.

What the record contains

  • the identity of the controller;
  • the purpose of each activity;
  • the categories of data subjects and of personal data;
  • the categories of recipients;
  • the retention period;
  • the security measures;
  • the foreign states and the safeguards, if the data goes abroad.

Related questions

Useful templates

General guidance, not advice on your case: for your case the text of the law is what counts, and the assessment remains yours.