# EasyLPD

> Bring your company in line with the Swiss FADP and the GDPR: free self-assessment, action plan, record of processing, privacy notices and signatures. Data stored in Switzerland. Run by Advisorn GmbH, Chiasso, Switzerland. Called EasyDSG in German.

EasyLPD is a self-service platform for Swiss SMEs to comply with the Swiss Federal Act on Data Protection (FADP, in Italian LPD, in German DSG, in French LPD) and, where it applies, the EU GDPR and the EU AI Act. One questionnaire gives a score per law and a step-by-step plan; the platform then holds the record of processing, generates the documents, keeps track of vendors, breaches, requests and DPIAs, and collects signatures. It certifies nothing and gives no legal advice: consulting is sold separately by Advisorn.

## Pages (English)

- [Home](https://easylpd.ch/en)
- [Free self-assessment (FADP and GDPR, 5 minutes, no account)](https://easylpd.ch/en/self-assessment)
- [The new Swiss FADP in brief: what it asks of SMEs](https://easylpd.ch/en/compliance)
- [Questions on the new FADP: short answers with the articles](https://easylpd.ch/en/fadp-questions)
- [Document templates for the FADP and the GDPR: what each is for and what it contains](https://easylpd.ch/en/fadp-templates)
- [Countries with adequate data protection under the FADP (Annex 1 DPO) and the GDPR (adequacy decisions), side by side](https://easylpd.ch/en/adequate-data-protection-countries)
- [Free tools: must we keep a record of processing, is a DPIA needed, may data go to this country, must this breach be notified](https://easylpd.ch/en/fadp-tools)
- [Data protection by sector: medical practices, fiduciaries, online shops, associations, private schools, hotels and restaurants](https://easylpd.ch/en/industries)
- [Glossary of data protection: the terms of the FADP and the GDPR with their articles](https://easylpd.ch/en/data-protection-glossary)
- [Data protection news from Switzerland: FDPIC decisions, court rulings, adequacy, each with what it means for an SME](https://easylpd.ch/en/data-protection-news)
- [Features](https://easylpd.ch/en/features)
- [Pricing](https://easylpd.ch/en/pricing)
- [Consulting by Advisorn](https://easylpd.ch/en/consulting)
- [Swiss representative under Art. 14 FADP, for companies abroad (Advisorn, Chiasso)](https://easylpd.ch/en/swiss-representative)
- [Mandate as representative in Switzerland (the contract accepted before paying)](https://easylpd.ch/en/representative-mandate)
- [EasyCookie, a Swiss cookie banner: consents kept in Zurich without IP addresses, FADP and GDPR modes](https://easylpd.ch/en/cookie-banner)
- [MCP server for AI assistants](https://easylpd.ch/en/ai-assistants)
- [Frequently asked questions](https://easylpd.ch/en/faq)
- [About us](https://easylpd.ch/en/about-us)
- [Contact](https://easylpd.ch/en/contact)
- [Sub-processors](https://easylpd.ch/en/subprocessors)
- [Privacy notice](https://easylpd.ch/en/privacy)

## Questions on the new FADP

- [Does the new FADP apply to my SME?](https://easylpd.ch/en/fadp-questions/does-the-new-fadp-apply-to-my-sme): Yes, to every business that processes data on people, whatever its size.
- [Revised FADP and GDPR: what are the differences, and when do both apply?](https://easylpd.ch/en/fadp-questions/fadp-vs-gdpr-differences): Similar principles, different rules on legal basis, deadlines and sanctions.
- [What sanctions does the new FADP provide for, and on whom?](https://easylpd.ch/en/fadp-questions/fadp-fines-and-sanctions): Fines up to CHF 250,000 on the responsible individual, for wilful breaches.
- [Is a record of processing activities required under the new FADP?](https://easylpd.ch/en/fadp-questions/fadp-record-of-processing-activities): Yes, as a rule; below 250 employees it depends on the risk.
- [Do I have to appoint a data protection officer (DPO)?](https://easylpd.ch/en/fadp-questions/fadp-data-protection-officer-dpo): Under the FADP no, it is optional; under the GDPR sometimes yes.
- [What must a privacy notice contain?](https://easylpd.ch/en/fadp-questions/fadp-privacy-notice-what-to-include): At least who you are, why you process data, who gets it and where it goes.
- [Is a data protection impact assessment (DPIA) required?](https://easylpd.ch/en/fadp-questions/fadp-data-protection-impact-assessment-dpia): Only for processing that may result in a high risk.
- [Can I use vendors with servers in the United States or the EU?](https://easylpd.ch/en/fadp-questions/fadp-vendors-servers-usa-eu-data-transfers): Yes: to the EU freely, to the US with the Data Privacy Framework or safeguards.
- [Do we need a contract with vendors that process data for us?](https://easylpd.ch/en/fadp-questions/fadp-data-processing-agreement-processors): Yes, with anyone who processes data on your behalf (Art. 9 FADP).
- [Cookies and banners: is consent required in Switzerland?](https://easylpd.ch/en/fadp-questions/cookies-switzerland-consent-fadp): As a rule, informing and allowing refusal is enough; under the GDPR consent is needed.
- [Data security breach: when and how to notify the FDPIC?](https://easylpd.ch/en/fadp-questions/data-breach-notification-fdpic-fadp): As soon as possible, when the risk to the people concerned is high.
- [How to answer a request for access to personal data, and within what time?](https://easylpd.ch/en/fadp-questions/fadp-right-of-access-request-deadline): Free of charge and usually within 30 days, after checking who is asking.
- [What is personal data under the new FADP?](https://easylpd.ch/en/fadp-questions/what-is-personal-data-fadp): Any information relating to an identified or identifiable natural person.
- [What is sensitive personal data?](https://easylpd.ch/en/fadp-questions/sensitive-personal-data-fadp): Health, religion, political opinions, genetic and biometric data, criminal proceedings and a few others.
- [New FADP in force since 1 September 2023: what has changed?](https://easylpd.ch/en/fadp-questions/new-swiss-fadp-what-changed-2023): More documentation, breach notification, higher fines, natural persons only.
- [Is consent required to process personal data in Switzerland?](https://easylpd.ch/en/fadp-questions/is-consent-required-swiss-fadp): As a rule no: respecting the principles of the law is enough; consent is needed only in some cases.
- [What is the FDPIC and what powers does it have?](https://easylpd.ch/en/fadp-questions/what-is-the-fdpic-and-its-powers): The federal supervisory authority: it investigates and orders measures, but does not impose fines.
- [Must a foreign company appoint a representative in Switzerland?](https://easylpd.ch/en/fadp-questions/swiss-representative-foreign-company-fadp): Yes, if it processes data of people in Switzerland regularly, on a large scale and with a high risk.
- [How long may personal data be kept?](https://easylpd.ch/en/fadp-questions/how-long-keep-personal-data-fadp): Only as long as needed for the purpose, except for periods set by other laws.
- [What data security measures does the new FADP require?](https://easylpd.ch/en/fadp-questions/data-security-measures-fadp): Measures fit for the risk: confidentiality, availability, integrity and traceability of the data.
- [What do privacy by design and privacy by default mean?](https://easylpd.ch/en/fadp-questions/privacy-by-design-by-default-fadp): Building data protection in from the start, and setting everything to the minimum necessary.
- [What employee data may an employer process?](https://easylpd.ch/en/fadp-questions/employee-data-what-employer-may-process-switzerland): Only data concerning suitability for the job or needed to perform the employment contract.
- [Can Microsoft 365 or Google Workspace be used under the new FADP?](https://easylpd.ch/en/fadp-questions/microsoft-365-google-workspace-fadp): Yes, with a data processing agreement, safeguards for transfers and careful configuration.
- [What are standard contractual clauses and when are they needed?](https://easylpd.ch/en/fadp-questions/standard-contractual-clauses-switzerland): A standard contract for sending data to a country without adequate protection.
- [May personal data be entered into ChatGPT or other AI tools?](https://easylpd.ch/en/fadp-questions/personal-data-chatgpt-ai-tools-fadp): Only with clear rules: a suitable contract, no sensitive data, information to the people concerned.
- [A person asks for their data to be deleted: what should we do?](https://easylpd.ch/en/fadp-questions/request-to-delete-personal-data-fadp): Delete it, unless there is a reason to keep it, and answer promptly.
- [What is the right to data portability?](https://easylpd.ch/en/fadp-questions/right-to-data-portability-fadp): Receiving one's own data in a commonly used electronic format, or having it passed to another.
- [What happens if the FDPIC opens an investigation?](https://easylpd.ch/en/fadp-questions/fdpic-investigation-what-happens): The business must cooperate; at the end the FDPIC can order measures by a ruling.
- [An e-mail with personal data went to the wrong person: is it a breach?](https://easylpd.ch/en/fadp-questions/email-sent-to-wrong-person-data-breach): Yes, it is a breach of data security; it must be notified only if the risk is high.
- [Video surveillance in a business or shop: what does the new FADP allow?](https://easylpd.ch/en/fadp-questions/video-surveillance-business-shop-switzerland): It is allowed if proportionate, signposted and with footage kept for a short time.
- [Newsletters: is consent needed to send marketing e-mails in Switzerland?](https://easylpd.ch/en/fadp-questions/newsletter-consent-email-marketing-switzerland): Yes, except to customers for similar products; every mailing must allow unsubscribing.
- [May an employer monitor employees' e-mails and internet use?](https://easylpd.ch/en/fadp-questions/employer-monitor-employee-email-internet-switzerland): Only with rules announced beforehand, anonymously first, individually only on concrete suspicion.
- [How long may the CVs of unsuccessful job applicants be kept?](https://easylpd.ch/en/fadp-questions/how-long-keep-job-applicant-cvs-switzerland): Until the end of the selection and a few months after; longer only with consent.
- [May photos of employees or customers be published on the website or social media?](https://easylpd.ch/en/fadp-questions/publish-photos-employees-customers-consent): As a rule only with the consent of the person, who can withdraw it.
- [Anonymous and pseudonymised data: does the new FADP apply?](https://easylpd.ch/en/fadp-questions/anonymous-pseudonymised-data-fadp): Not to truly anonymous data; to pseudonymised data yes, for whoever can re-link it.
- [What is profiling, and when is it high-risk?](https://easylpd.ch/en/fadp-questions/high-risk-profiling-fadp): Evaluating a person by automated means; high-risk if it yields a portrait of the personality.
- [Does the new FADP require employees to be trained?](https://easylpd.ch/en/fadp-questions/employee-data-protection-training-fadp): Not by an explicit provision, but training is one of the organisational measures expected.
- [Is there a new FADP certification for businesses?](https://easylpd.ch/en/fadp-questions/fadp-certification-switzerland): Yes, voluntary, issued by accredited bodies; it is not mandatory.
- [Children's data: do special rules apply?](https://easylpd.ch/en/fadp-questions/children-personal-data-switzerland-fadp): The FADP sets no age: capacity of judgement counts; the GDPR has thresholds for online services.
- [What are joint controllers?](https://easylpd.ch/en/fadp-questions/joint-controllers-fadp-gdpr): Two or more businesses that jointly decide the purposes and means of a processing.

## Free tools

- [Do I need a record of processing?](https://easylpd.ch/en/fadp-tools/do-i-need-a-record-of-processing-activities): Three questions to find out whether the FADP and the GDPR require a record of processing activities from you.
- [Is a DPIA required?](https://easylpd.ch/en/fadp-tools/is-a-dpia-required-check): Tick the risk signs of your processing and see whether a DPIA is likely to be needed.
- [Can I send data to this country?](https://easylpd.ch/en/fadp-tools/can-i-transfer-personal-data-to-this-country): Choose a country and see what the FADP and the GDPR require to transfer data there.
- [Data breach: do I have to notify it?](https://easylpd.ch/en/fadp-tools/data-breach-do-i-have-to-notify): A few questions about what happened: estimated risk, what the FADP and the GDPR require, and by when.

## Data protection news

- 2026-10-29 [Credit reference agency: creditworthiness data are not for marketing](https://easylpd.ch/en/data-protection-news/fdpic-credit-reference-agency-marketing-erasure): Data collected for one purpose may not be used for another the person cannot expect (Art. 6 para. 3 FADP). A request for erasure must be examined even when it gives no reason.
- 2026-10-22 [Advertising without provable consent: the FDPIC orders the data deleted](https://easylpd.ch/en/data-protection-news/fdpic-advertising-without-consent-add-conti): Consent to marketing must be documented, because the burden of proof is yours (Art. 6 and 31 FADP). Handing the replies to a service provider does not relieve you of responsibility.
- 2026-10-21 [Voice recognition: explicit consent is needed, carrying on talking is not enough](https://easylpd.ch/en/data-protection-news/federal-administrative-court-voice-recognition-consent): Biometric data that identify a person (voice, fingerprint, face) require explicit consent (Art. 5 let. c no. 4 and Art. 6 para. 7 FADP).
- 2026-10-16 [Generative AI at work: the campaign of the FDPIC and the Federal Office for Cybersecurity](https://easylpd.ch/en/data-protection-news/generative-ai-at-work-campaign-fdpic-ncsc): Give your staff written rules on what may go into an AI tool and what may not.
- 2026-10-01 [Bodycams on public transport: the FDPIC prohibits BLT from processing](https://easylpd.ch/en/data-protection-news/fdpic-bodycams-public-transport-blt): A private company does not need a law, but it must be able to justify video surveillance and keep it proportionate (Art. 6 and 31 FADP). Before installing it, assess the risks.
- 2026-09-16 [Digital monitoring in care homes: a joint guide of the FDPIC and the cantons](https://easylpd.ch/en/data-protection-news/digital-monitoring-care-homes-guide-fdpic-privatim): If you run a healthcare or care facility, document the choice in a risk analysis and train your staff.
- 2026-04-07 [Fake e-mails in the FDPIC's name accuse websites of breaching the FADP](https://easylpd.ch/en/data-protection-news/fake-emails-in-the-name-of-the-fdpic): Do not open attachments or links and do not pay anything. If in doubt, contact the FDPIC through its website.
- 2026-02-12 [Digitec Galaxus: personalisation can be switched off with one click](https://easylpd.ch/en/data-protection-news/digitec-galaxus-personalisation-can-be-switched-off): If you run an online shop, offer a simple way to object to profiling and say so at registration (Art. 6 para. 2 and Art. 30 para. 2 let. b FADP).
- 2026-01-26 [Brazil is adequate for the GDPR, not yet for the FADP](https://easylpd.ch/en/data-protection-news/brazil-adequate-gdpr-not-fadp): From Switzerland to Brazil, safeguards are still needed, for example standard contractual clauses (Art. 16 para. 2 FADP).

## By sector

- [Data protection for medical practices and therapists: what the Swiss FADP requires](https://easylpd.ch/en/industries/fadp-medical-practices-and-therapists): Doctors, dentists, physiotherapists, psychotherapists and other health professionals.
- [Data protection for fiduciaries: Swiss FADP, payroll and client data](https://easylpd.ch/en/industries/fadp-fiduciaries-and-accountants): Fiduciaries, accounting firms, payroll bureaus and tax advisers.
- [Data protection for online shops: Swiss FADP, GDPR, cookies and newsletters](https://easylpd.ch/en/industries/fadp-gdpr-online-shops): Online shops, marketplaces and businesses that sell on the web.
- [Data protection for associations and clubs: what the Swiss FADP requires](https://easylpd.ch/en/industries/fadp-associations-and-sports-clubs): Associations, sports clubs, cultural societies and foundations.
- [Data protection for private schools and nurseries: Swiss FADP, minors and platforms](https://easylpd.ch/en/industries/fadp-private-schools-and-nurseries): Private schools, nurseries, after-school care and language or music schools.
- [Data protection for hotels and restaurants: Swiss FADP, guests and bookings](https://easylpd.ch/en/industries/fadp-hotels-and-restaurants): Hotels, holiday homes, restaurants and bars.

## Cookie banner guides (easycookie.ch)

- [Cookie banners in Switzerland: when you need one and what it must do](https://easycookie.ch/en/guides/cookie-banner-switzerland): Inform or ask for consent: what the TCA, the FADP and the FDPIC's guide say, and when the GDPR comes in.
- [Google Analytics and the new FADP: what you need to use it in Switzerland](https://easycookie.ch/en/guides/google-analytics-fadp): Banner, privacy notice, data in the United States and the Google Analytics 4 settings to check.
- [Google Consent Mode v2 explained simply](https://easycookie.ch/en/guides/google-consent-mode-v2): The consent signals Google's tags read, basic and advanced mode, and who needs them.
- [Cookie policy: what to write for the new FADP and the GDPR](https://easycookie.ch/en/guides/cookie-policy-what-to-include): What it must say, where to put it and how to keep it up to date.
- [Cookie banner on WordPress, with the EasyLPD Cookie Banner plugin](https://easycookie.ch/en/guides/cookie-banner-wordpress): The plugin puts the line first on every page and adds two shortcodes.
- [Cookie banner on Wix: where to paste the line](https://easycookie.ch/en/guides/cookie-banner-wix): Custom code in the head, on all pages; marketing integrations separately.
- [Cookie banner on Shopify: the line in the theme](https://easycookie.ch/en/guides/cookie-banner-shopify): The line in theme.liquid, right after the opening of the head; Shopify's pixels stay with Shopify.
- [Cookie banner on Squarespace: Code Injection](https://easycookie.ch/en/guides/cookie-banner-squarespace): The line first in the header Code Injection; Squarespace's banner must be switched off.
- [Cookie banner on Webflow: the head code](https://easycookie.ch/en/guides/cookie-banner-webflow): The line first in Head code, then publish the site.
- [Cookie banner on Jimdo: where to paste the line](https://easycookie.ch/en/guides/cookie-banner-jimdo): In Jimdo Creator the line goes in Edit Head, on the first line.
- [Cookie banner on TYPO3, Joomla, Drupal, Contao and PrestaShop](https://easycookie.ch/en/guides/cookie-banner-typo3-joomla-drupal): One extension for each, which puts the line first; in beta.

## Document templates

- [Email confidentiality notice template](https://easylpd.ch/en/fadp-templates/email-confidentiality-notice): Short text to be added at the foot of business e-mails, with the confidentiality notice and a reference to the privacy notice.
- [Template for notifying data subjects of a data security breach](https://easylpd.ch/en/fadp-templates/data-breach-notification-data-subjects): Template letter for informing, in plain language, the persons whose data have been affected by a security breach.
- [Parental consent form template for processing a child's data](https://easylpd.ch/en/fadp-templates/parental-consent-form-children-data): Form by which a parent or legal representative consents to the processing of a minor's personal data; to be used when the processing requires consent and the minor cannot give it alone.
- [Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)](https://easylpd.ch/en/fadp-templates/data-processing-agreement): Agreement to be signed with every provider that processes personal data on behalf of the organisation (hosting, cloud, payroll, newsletter, IT support), with annexes on the processing, security measures and sub-processors.
- [Cookie policy template for Swiss and European websites](https://easylpd.ch/en/fadp-templates/cookie-policy): Notice on the cookies and similar technologies used by the website, with the categories, how to accept or refuse them and the browser settings.
- [Template resolution launching the new FADP compliance programme](https://easylpd.ch/en/fadp-templates/resolution-fadp-compliance-programme): Decision by which the governing body launches compliance with data protection law, assigns internal roles and sets priorities; to be adopted at the start of the process and kept on file.
- [Employee data protection training programme template](https://easylpd.ch/en/fadp-templates/employee-data-protection-training-programme): Programme of data protection training sessions for employees, with topics, target groups, assessment of learning and attendance register.
- [Employee confidentiality undertaking and instructions template](https://easylpd.ch/en/fadp-templates/employee-confidentiality-undertaking): Declaration by which an employee with access to personal data undertakes to keep them confidential and receives the instructions for processing them; to be signed on recruitment or at the start of the assignment.
- [App privacy notice template](https://easylpd.ch/en/fadp-templates/app-privacy-notice): Notice to be published in the mobile app and on its app store page; it explains which data the app collects, which device permissions it uses and what rights users have.
- [Job applicant privacy notice template](https://easylpd.ch/en/fadp-templates/job-applicant-privacy-notice): Notice for people applying for a job; it explains how application data are processed, how long they are kept and on what conditions they remain in a talent pool.
- [Privacy notice template for customers and contractual partners](https://easylpd.ch/en/fadp-templates/customer-privacy-notice): Notice to be given to customers and contractual partners when the contract is concluded, with a separate, optional section for marketing consent.
- [Employee privacy notice template](https://easylpd.ch/en/fadp-templates/employee-privacy-notice): Notice to be given to employees on recruitment; it explains which data the employer processes in the employment relationship, why, for how long and with what rights.
- [Website privacy notice template (FADP and GDPR)](https://easylpd.ch/en/fadp-templates/website-privacy-notice): Notice to be published on the website; it explains to visitors which data are collected, why, to whom they are disclosed and what rights they have.
- [Video surveillance notice and sign template](https://easylpd.ch/en/fadp-templates/video-surveillance-notice-sign): Short text for the sign to be displayed at the entrance to areas under video surveillance and full notice to be kept available for visitors, customers and employees.
- [Image release form template for customers, guests and visitors](https://easylpd.ch/en/fadp-templates/image-release-form-customers-guests): Form by which customers, guests and event visitors consent to the use of photographs and videos in which they appear, separately for each communication channel; to be signed before publication.
- [Employee image release form template](https://easylpd.ch/en/fadp-templates/employee-image-release-form): Form by which employees consent freely, and separately for each channel, to the use of photographs and videos in which they appear in corporate communication; to be signed before any publication.
- [Technical and organisational security measures (TOMs) template](https://easylpd.ch/en/fadp-templates/technical-organisational-security-measures): Description of the technical and organisational measures by which the organisation protects personal data, with tables to be completed on status and notes; it serves as evidence of security and as an annex to contracts.
- [Personal data access request form template](https://easylpd.ch/en/fadp-templates/data-subject-access-request-form): Form by which a person asks whether personal data about them are processed and which ones, and to receive a copy; to be published on the website or given to anyone who asks for it.
- [Request form template for erasure, rectification or objection](https://easylpd.ch/en/fadp-templates/data-erasure-request-form): Form by which a person requests the deletion of their personal data or, alternatively, their rectification, or objects to processing; to be published on the website or given to anyone who asks for it.
- [Internal form template for reporting a data security breach](https://easylpd.ch/en/fadp-templates/internal-data-breach-report-form): Internal form with which every employee immediately reports a breach, even a merely suspected one, of the security of personal data.
- [Appointment letter template for the data protection advisor (DPO)](https://easylpd.ch/en/fadp-templates/data-protection-advisor-appointment-letter): Letter by which the organisation designates the data protection advisor (Art. 10 FADP) or the data protection officer (Art. 37 GDPR), internal or external, and sets out the tasks, independence and resources of the function.
- [Mandate template for the EU representative (Art. 27 GDPR)](https://easylpd.ch/en/fadp-templates/gdpr-eu-representative-mandate): Written mandate by which an organisation not established in the European Union designates its representative under Art. 27 GDPR and defines the representative's tasks and limits.
- [Template for appointing an internal data protection contact](https://easylpd.ch/en/fadp-templates/internal-data-protection-contact-appointment): Instrument by which the organisation entrusts a person with a data protection role (internal contact, handling of requests, handling of breaches), with tasks, powers and a deputy.
- [Template for notifying a data security breach to the authority](https://easylpd.ch/en/fadp-templates/data-breach-notification-authority): Template for notifying a data security breach to the data protection authority, with all the information required by law.
- [BYOD policy template on the use of private devices at work](https://easylpd.ch/en/fadp-templates/byod-policy-private-devices): Rules for employees who use private smartphones, tablets or computers for work, with security requirements, separation of data, limits on company checks and a declaration of acceptance.
- [Data retention policy template with retention periods](https://easylpd.ch/en/fadp-templates/data-retention-policy): Internal rules on how long personal data are kept and how they are disposed of, with a table of retention periods per category of documents to be completed.
- [Internal data protection policy template](https://easylpd.ch/en/fadp-templates/internal-data-protection-policy): Internal rules by which the organisation sets out principles, roles and procedures for the processing of personal data; it applies to all employees and is the reference document of the data protection programme.
- [Company policy template on the use of artificial intelligence](https://easylpd.ch/en/fadp-templates/ai-use-policy): Rules for employees on the use of artificial intelligence tools, with a list of approved tools, data that must not be entered, human review of the results and an inventory of use cases.
- [Data security breach procedure template (data breach)](https://easylpd.ch/en/fadp-templates/data-breach-procedure): Internal procedure setting out who does what when personal data are lost, stolen, altered or made accessible to unauthorised persons, from discovery to notification and closure of the case.
- [Procedure template for handling data subject requests](https://easylpd.ch/en/fadp-templates/data-subject-request-procedure): Internal procedure setting out how to receive, verify, process and document the requests by which individuals exercise their rights (access, rectification, erasure, objection, portability, automated decisions).
- [Data security breach register template](https://easylpd.ch/en/fadp-templates/data-breach-register): Register in which to document every data security breach, whether notified or not, with the facts, the consequences, the measures taken and the decisions made.
- [Rules template on the use of company IT tools](https://easylpd.ch/en/fadp-templates/it-acceptable-use-policy): Rules for employees on the use of computers, email, the internet and cloud services, with the limits on monitoring by the employer and the duty to report incidents.
- [Parental consent withdrawal form template](https://easylpd.ch/en/fadp-templates/parental-consent-withdrawal-form): Form with which a parent or the legal representative withdraws the consent given for the processing of a minor's data; to be handed over together with the parental consent form.
- [Consent withdrawal form template](https://easylpd.ch/en/fadp-templates/consent-withdrawal-form): Form with which a person withdraws consent given previously; to be made available wherever consent is collected.
- [Response templates for data subject requests](https://easylpd.ch/en/fadp-templates/data-subject-request-response-templates): Collection of letters ready to be adapted and sent to persons exercising their rights (acknowledgement of receipt, identity verification, reply to an access request, confirmation of erasure, reasoned refusal, extension of the time limit).
- [Data protection impact assessment (DPIA) template](https://easylpd.ch/en/fadp-templates/data-protection-impact-assessment): Template for assessing, before starting processing that may entail a high risk, the risks to individuals and the measures to reduce them, and for documenting the decision.
- [Legitimate interest assessment (LIA) template](https://easylpd.ch/en/fadp-templates/legitimate-interest-assessment): Worksheet for verifying and documenting, with the three-step test, that processing can be based on the organisation's interest without unduly overriding the rights of individuals.
- [Data security breach risk assessment template](https://easylpd.ch/en/fadp-templates/data-breach-risk-assessment): Worksheet for assessing the risk that a breach entails for the persons affected and for documenting the decision whether or not to notify the authority and the data subjects.
- [Template for assessing a transfer of data abroad (TIA)](https://easylpd.ch/en/fadp-templates/transfer-impact-assessment): Worksheet for documenting and assessing a transfer of personal data to a country without adequate protection, from the basis of the transfer to the supplementary measures and the conclusion.

## Other languages

- Italian: https://easylpd.ch
- German (EasyDSG): https://easydsg.ch
- French: https://easylpd.ch/fr

## For AI assistants

- [MCP server](https://easylpd.ch/api/mcp): public, no account, nothing stored. Tools: which_laws_apply, action_plan, assessment_questions, score_assessment, transfer_check, fadp_obligations, document_templates, fadp_questions.
- [Full text for language models](https://easylpd.ch/llms-full.txt): the content of these pages in one file.