Data Protection Principles and Responsibilities

A private person or federal body that decides the purpose and means of processing personal data.

A person or body that processes data on behalf of a controller, but doesn't decide the purpose.

Data processing must be legal and comply with all data protection laws.

Data processing must be conducted honestly and with good intentions.

The purpose for processing data must be clearly established and justified.

Data should be processed only if it's necessary to achieve the stated purpose.

Processed data should be accurate and up-to-date.

Data should be kept only as long as necessary for the stated purpose.

The ability of a data subject to receive confirmation from a data controller as to whether or not personal data concerning them is being processed, and if so, to access that data.

A document that informs individuals about the processing of their personal data, covering topics such as the purpose and legal basis for processing, the identity of the controller, and the rights of the data subject.

A structured process mandated by data protection regulations to assess and mitigate potential risks associated with the processing of personal data.

The scope of application of the Federal Data Protection Act (FADP) regulates which entities and data processing activities fall under its jurisdiction.

The scope of application of the General Data Protection Regulation (GDPR) defines which entities and data processing activities are subject to its provisions.

The scope of application of the Data Protection Act of the Canton of Zurich (IDG Kanton Zürich) determines which entities and data processing activities are subject to its rules.

A legal concept in Swiss Civil Code, defining the exclusive rights and control over a physical object.

A defense against a breach of personality rights claim, allowing for data processing when the individual has given explicit permission. This consent must be specific to the type of data processing, adequately informed, and freely given.

When the public or private interest outweighs the individual's right to data protection, allowing for data processing, even without consent. This involves a careful balancing of interests.

A legal basis justifying data processing, which is explicitly required, authorized, or tacitly assumed by law.

A type of processing that involves analyzing an individual's personal information to predict their behaviour or preferences.

A category of sensitive personal data that requires explicit consent for processing. Examples include: health information, religious beliefs, political opinions, and biometric data.

The data subject's power to withdraw their consent for data processing at any time.

The right to restrict the processing of personal data based on the principles of data minimization and purpose limitation.

An individual whose personal information is being processed.

Ensuring that appropriate technical and organizational measures are in place to protect personal data against unauthorized access, use, disclosure, alteration, or destruction, taking into account the risk involved. It ensures data is secure even when faced with potential threats.

A proactive design approach that integrates data protection considerations at every stage of a system's development, ensuring data is protected by default and by design. It minimizes risks and promotes data security throughout the system's lifecycle.

The entity that determines the purposes and means of processing personal data. They are responsible for the security of the data they process.

The entity processing personal data on behalf of the controller. They process data according to instructions from the controller and are responsible for maintaining data security.

A set of practices that minimizes the collection and use of personal data by limiting data acquisition and processing to what is absolutely necessary for a specific purpose. This principle promotes data security by reducing the amount of sensitive data at risk.

The requirement for data security to be proportional to the risk involved, ensuring higher security measures for more sensitive data.

The obligation to implement technical measures like encryption, firewalls, and access controls to protect data from unauthorized access and breaches.

The obligation to implement organizational measures like data access policies, staff training, and data breach response protocols to protect data from unauthorized access and breaches.

This involves formal procedures where both involved parties have the opportunity to present their perspectives. The data controller can explain their actions and make efforts to comply before any sanctions are applied.

This refers to legal consequences for intentionally breaking specific rules of data protection. The consequences apply to individuals or companies.

These are specific actions that go against the data protection laws. Examples include not cooperating with investigations or disclosing confidential data.

Enforcement of the FADP is the duty of the government authorities at the cantonal level (similar to state or regional levels). They have the power to impose fines for violations, up to a limit of CHF 250,000 for each violation.

The main focus is placed on actions done intentionally. Actions done by mistake might not result in criminal charges.

A person's request to a company for information about how their personal data is handled. This includes knowing the reason for the data collection and how it's used.

The FDPIC, a body responsible for data protection, investigates when a breach of data protection rules happens. They look into the cause and, if needed, demand changes to prevent similar incidents in the future.

The employer faces consequences under the law when an employee misuses confidential data. This situation highlights the responsibility of employers to train and set clear guidelines for data handling.

The FADP determines the obligations and liability for data controllers and processors based on their roles in data processing.

The FADP requires controllers to implement appropriate security measures, inform data subjects, perform DPIAs for high-risk processing, and consult the FDPIC if high risks remain.

Processors must only process data according to instructions from the controller, implement agreed-upon security measures, and adhere to the data processing agreement.

Controllers and processors share responsibility for data security and are both obligated to report any data breaches affecting personal data.

The FADP mandates that processors only process data based on documented instructions from controllers. This prevents unauthorized use of data.

Processors must implement technical and organizational measures to protect data, ensuring its confidentiality, integrity, and availability. This could involve encryption or access controls.

Controllers and processors must formally outline their data processing relationship in a legally binding agreement, specifying processing scope, security measures, and subcontractor responsibilities.

Processors require prior permission from controllers to engage subcontractors. This ensures the controller retains control over the data even when it's handled by a third party.