All Countries
Data Privacy
Sub Processing Agreement

Sub Processing Agreement Template for Switzerland

Create a bespoke document in minutes,  or upload and review your own.

4.6 / 5
4.8 / 5

Let's create your Sub Processing Agreement

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get your first 2 documents free

Your data doesn't train Genie's AI

You keep IP ownership of your information

Key Requirements PROMPT example:

Sub Processing Agreement

"I need a Sub Processing Agreement under Swiss law for engaging a cloud service provider based in Germany to process our customer data, with implementation planned for March 2025 and specific emphasis on financial services compliance requirements."

Celebrated by
Collaborations with
Investors
Document background
A Sub Processing Agreement is essential when a primary data processor needs to engage another entity (sub-processor) to process personal data on its behalf. This document is particularly crucial in the Swiss legal context, where data protection requirements are stringent and align closely with European standards. The agreement must comply with the Swiss Federal Data Protection Act (FADP/DSG) and may also need to address GDPR requirements if European data is involved. It typically includes detailed provisions on data security measures, breach reporting obligations, audit rights, and liability arrangements. The Sub Processing Agreement is commonly used in outsourcing arrangements, cloud services implementations, or any scenario where data processing activities are delegated to third parties. It serves as a critical tool for ensuring unbroken accountability and compliance in data processing chains.
Suggested Sections

1. Parties: Identification of the main processor and sub-processor, including full legal names, registration details, and addresses

2. Background: Context of the agreement, reference to the main processing agreement, and the need for sub-processing services

3. Definitions: Key terms used throughout the agreement, including specific Swiss law terminology and data protection concepts

4. Scope and Purpose: Detailed description of the sub-processing services and the types of personal data to be processed

5. Duration and Termination: Term of the agreement, termination conditions, and consequences of termination

6. Sub-processor Obligations: Core obligations including data processing instructions, confidentiality, security measures, and compliance requirements

7. Data Protection Safeguards: Specific measures to ensure compliance with Swiss FADP and other applicable data protection laws

8. Security Requirements: Mandatory security measures and protocols for data protection

9. Audit Rights: Processor's rights to audit and inspect sub-processor's compliance

10. Data Breach Notification: Procedures and timeframes for reporting data breaches

11. Liability and Indemnification: Allocation of responsibility and liability between parties

12. General Provisions: Standard contractual terms including governing law, jurisdiction, and entire agreement provisions

Optional Sections

1. International Data Transfers: Required if personal data will be transferred outside Switzerland, including specific safeguards and mechanisms

2. Industry-Specific Compliance: Additional provisions for regulated industries (e.g., financial services, healthcare)

3. Disaster Recovery: Detailed business continuity and disaster recovery procedures, recommended for critical services

4. Insurance Requirements: Specific insurance obligations, recommended for high-risk processing activities

5. Sub-sub-processing: Terms governing any further sub-processing, if permitted

6. Special Categories of Data: Additional safeguards for processing sensitive personal data

7. Exit Management: Detailed procedures for transition of services upon termination, recommended for complex processing arrangements

Suggested Schedules

1. Schedule 1 - Processing Activities: Detailed description of processing activities, including categories of data subjects, types of personal data, and processing purposes

2. Schedule 2 - Technical and Organizational Measures: Comprehensive list of security measures and controls implemented by the sub-processor

3. Schedule 3 - Service Levels: Performance metrics and service level requirements for the sub-processing services

4. Schedule 4 - Fee Schedule: Pricing and payment terms for the sub-processing services

5. Schedule 5 - Approved Sub-sub-processors: List of any approved further sub-processors, if applicable

6. Appendix A - Data Breach Response Plan: Detailed procedures and contact information for handling data breaches

7. Appendix B - Audit Procedures: Specific procedures and requirements for conducting audits

Authors

Alex Denne

Head of Growth (Open Source Law) @ Genie AI | 3 x UCL-Certified in Contract Law & Drafting | 4+ Years Managing 1M+ Legal Documents | Serial Founder & Legal AI Author

Linkedin in social icon imageX social icon image
alex.den.21@genieai.co
Relevant legal definitions
Agreement
Applicable Data Protection Laws
Authorized Persons
Business Day
Confidential Information
Controller
Data Subject
Data Protection Impact Assessment
EEA
FADP
GDPR
Group
Information Security Incident
Main Processing Agreement
Personal Data
Personal Data Breach
Processing
Processor
Processor Personnel
Professional Services
Relevant Transfer
Security Measures
Sensitive Personal Data
Services
Standard Contractual Clauses
Sub-processor
Sub-processing Services
Swiss Law
Technical and Organizational Measures
Term
Third Country
Transfer Mechanism
Written Instructions
Clauses
Interpretation
Appointment of Sub-processor
Scope of Processing
Data Protection Compliance
Technical and Organizational Measures
Confidentiality
Sub-processor Personnel
Security Breach Notification
Audit Rights
International Data Transfers
Data Subject Rights
Record Keeping
Liability and Indemnification
Insurance
Term and Termination
Return or Deletion of Data
Governing Law and Jurisdiction
Assignment and Subcontracting
Force Majeure
Notices
Severability
Entire Agreement
Variation
Waiver
Third Party Rights
Costs
Counterparts
Relevant Industries

Information Technology

Cloud Services

Financial Services

Healthcare

Telecommunications

Professional Services

E-commerce

Manufacturing

Insurance

Pharmaceutical

Education

Research and Development

Consulting

Relevant Teams

Legal

Compliance

Information Security

IT

Privacy

Procurement

Vendor Management

Risk Management

Operations

Data Protection

Information Governance

Relevant Roles

Data Protection Officer

Privacy Officer

Legal Counsel

Compliance Manager

Information Security Manager

IT Director

Chief Technology Officer

Chief Information Security Officer

Procurement Manager

Vendor Management Officer

Risk Manager

Operations Director

Chief Legal Officer

Privacy Counsel

Contract Manager

Industries
Swiss Federal Data Protection Act (FADP/DSG): The fundamental Swiss law governing data protection and privacy, recently revised to align more closely with GDPR standards. This is crucial for determining data processing requirements and responsibilities.
Swiss Federal Data Protection Ordinance: The implementing ordinance that provides detailed requirements and specifications for implementing the FADP, including specific requirements for data processors and sub-processors.
Swiss Code of Obligations (OR): The primary source of Swiss contract law that governs the fundamental aspects of contractual relationships, including formation, performance, and termination of contracts.
EU General Data Protection Regulation (GDPR): While not Swiss law, it's relevant due to its extraterritorial scope and Switzerland's close alignment with EU standards. Many Swiss businesses need to comply with both GDPR and FADP.
FINMA Circulars (if financial sector): If the sub-processing involves financial services, FINMA regulations regarding outsourcing and data handling must be considered, particularly Circular 2018/3 on Outsourcing.
Swiss Federal Act on International Private Law (IPRG): Relevant for determining applicable law and jurisdiction in cases involving international parties or cross-border data transfers.
Swiss Criminal Code: Contains provisions relevant to data protection violations and business confidentiality, including Article 162 regarding breach of manufacturing or trade secrets.
Teams

Employer, Employee, Start Date, Job Title, Department, Location, Probationary Period, Notice Period, Salary, Overtime, Vacation Pay, Statutory Holidays, Benefits, Bonus, Expenses, Working Hours, Rest Breaks,  Leaves of Absence, Confidentiality, Intellectual Property, Non-Solicitation, Non-Competition, Code of Conduct, Termination,  Severance Pay, Governing Law, Entire Agreemen

Find the exact document you need

International Data Transfer Addendum

Swiss law-governed addendum for regulating international personal data transfers, ensuring compliance with FADP requirements and data protection standards.

find out more

Intra Group Agreement Data Protection

Swiss law-governed agreement regulating data protection and transfers between group companies under FADP/DSG.

find out more

Joint Controller Agreement

A Swiss law-governed agreement establishing responsibilities and obligations between joint controllers for personal data processing under FADP and considering GDPR requirements.

find out more

Standard Data Processing Agreement

Swiss law-governed Data Processing Agreement establishing controller-processor obligations under FADP/DSG and aligned with GDPR requirements.

find out more

Data Addendum

Swiss law-governed data protection addendum establishing data processing obligations and compliance with FADP/DPA requirements.

find out more

Data Processing Addendum DPA

A Swiss law-governed agreement defining terms and responsibilities for personal data processing between controller and processor, ensuring compliance with FADP/revFADP and relevant GDPR requirements.

find out more

International Data Protection Agreement

Swiss law-governed agreement regulating international data protection and cross-border data transfers, ensuring compliance with Swiss FADP and relevant international standards.

find out more

Data Sharing Agreement Controller To Processor

Swiss law-governed Data Sharing Agreement between Controller and Processor, ensuring FADP/LPD compliance and establishing data processing safeguards.

find out more

Processor To Processor DPA

A Swiss law-governed agreement between two data processors establishing terms and conditions for delegated data processing activities.

find out more

Controller To Controller Data Processing Agreement

Swiss law-governed agreement establishing data sharing framework between two independent data controllers, ensuring FADP compliance and defining mutual data protection responsibilities.

find out more

Intercompany Data Processing Agreement

Swiss law-governed agreement regulating intra-group personal data processing activities, ensuring compliance with Swiss FADP and relevant GDPR requirements.

find out more

Controller To Controller DPA

Swiss law-governed agreement between two data controllers establishing framework for lawful personal data sharing and processing.

find out more

DPA Agreement

Swiss law-governed Data Processing Agreement defining controller-processor relationships and compliance requirements under FADP/DSG.

find out more

Order Processing Agreement

A Swiss law-governed agreement between a data controller and processor that establishes obligations and responsibilities for personal data processing under FADP/DSG.

find out more

Data Privacy Addendum

Swiss law-governed Data Privacy Addendum ensuring compliance with Swiss FADP/revFADP and alignment with GDPR requirements for personal data processing.

find out more

Sub Processing Agreement

A Swiss law-governed agreement establishing terms for sub-processor data handling, ensuring compliance with Swiss FADP and related data protection requirements.

find out more

International Data Transfer Agreement

Swiss-law governed International Data Transfer Agreement for compliant cross-border personal data transfers under the revFDPA.

find out more

Data Protection Addendum

A Swiss law-governed Data Protection Addendum establishing data processing requirements and responsibilities between parties under Swiss FADP/DSG.

find out more

Download our whitepaper on the future of AI in Legal

By providing your email address you are consenting to our Privacy Notice.
Thank you for downloading our whitepaper. This should arrive in your inbox shortly. In the meantime, why not jump straight to a section that interests you here: https://www.genieai.co/our-research
Oops! Something went wrong while submitting the form.

Genie’s Security Promise

Genie is the safest place to draft. Here’s how we prioritise your privacy and security.

Your documents are private:

We do not train on your data; Genie’s AI improves independently

All data stored on Genie is private to your organisation

Your documents are protected:

Your documents are protected by ultra-secure 256-bit encryption

Our bank-grade security infrastructure undergoes regular external audits

We are ISO27001 certified, so your data is secure

Organizational security

You retain IP ownership of your documents

You have full control over your data and who gets to see it

Innovation in privacy:

Genie partnered with the Computational Privacy Department at Imperial College London

Together, we ran a £1 million research project on privacy and anonymity in legal contracts

Want to know more?

Visit our Trust Centre for more details and real-time security updates.

Read our Privacy Policy.