Commissioned Data Processing Agreement Template for Switzerland

The Commissioned Data Processing Agreement is a critical legal instrument required under Swiss data protection law when one organization (the processor) processes personal data on behalf of another organization (the controller). This agreement is mandatory under the Federal Act on Data Protection (FADP/DSG) whenever external data processing occurs. It serves to establish clear responsibilities, obligations, and security requirements for both parties, ensuring compliance with Swiss data protection regulations. The document becomes particularly important in contexts involving sensitive data, cross-border transfers, or complex processing operations. It must reflect the requirements of the revised FADP/DSG that came into force in 2023, while potentially accommodating GDPR requirements for organizations dealing with EU data subjects.

1. Parties: Identification of the data controller (principal) and data processor (contractor), including full legal names, addresses, and registration details

2. Background: Context of the agreement, relationship between parties, and purpose of the data processing arrangement

3. Definitions: Key terms used in the agreement, aligned with FADP/DSG terminology

4. Subject Matter and Duration: Scope of processing activities and duration of the agreement

5. Nature and Purpose of Processing: Detailed description of the processing activities and their intended purposes

6. Type of Personal Data and Categories of Data Subjects: Specification of personal data types to be processed and categories of individuals whose data will be processed

7. Obligations and Rights of the Controller: Controller's responsibilities, including instructions for processing and audit rights

8. Processor Obligations: Core obligations of the processor including processing only on documented instructions, confidentiality, security measures

9. Technical and Organizational Measures: Security measures to be implemented by the processor to ensure appropriate data protection

10. Data Subject Rights: Procedures for handling data subject requests and processor's assistance obligations

11. Data Breach Notification: Procedures and timeframes for reporting personal data breaches

12. Audit Rights and Cooperation: Controller's audit rights and processor's cooperation obligations

13. Liability and Indemnities: Allocation of liability and indemnification provisions

14. Term and Termination: Duration of agreement, termination conditions, and obligations post-termination

15. Governing Law and Jurisdiction: Specification of Swiss law as governing law and jurisdiction for disputes