Switzerland revFADP

Revised Swiss Federal Act on Data Protection - notification, DPIA, data subject rights, processor duties.


Short name	revFADP
Region	Europe
Country or scope	Switzerland
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers revFADP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for revFADP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for revFADP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CH-FADP-8` Data Security	Controllers and processors must ensure security of personal data appropriate to the risk through technical and organizational measures; verifiable integrity of the software inventory evidences such measures (revFADP Art. 8)	Scan
`CH-FADP-7` Privacy by Design and Default	Processing must be designed from planning onward to respect data protection rules; precisely pinned component versions (no wildcards, ranges or 'latest') reflect the disciplined engineering this design duty demands (revFADP Art. 7)	Scan
`CH-FADP-12` Record of Processing Activities	Controllers and processors must maintain a record of their processing activities; an enumerated inventory of the software components performing processing underpins that record (revFADP Art. 12)	Scan
`CH-FADP-9` Processing by Processors	Assignment of processing to a processor requires contractual or legal safeguards and controller oversight, which presupposes knowing the suppliers behind the software in the processing chain (revFADP Art. 9)	Scan
`CH-FADP-24` Breach Notification Readiness	Data security breaches likely to pose high risk must be reported to the FDPIC as quickly as possible; rapid impact assessment requires the versions of affected software components to be known (revFADP Art. 24)	Scan
`CH-FADP-16` Cross-Border Disclosure Readiness	Personal data may only be disclosed abroad when adequate protection is guaranteed; determining which systems disclose what requires components to be precisely identifiable (revFADP Art. 16)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`FADP-ART5`	Lawfulness, Purpose Limitation and Proportionality (Art. 5-7)
`FADP-ART19`	Privacy Notice and Transparency (Art. 19-20)
`FADP-ART21`	Data Subject Rights: Access and Rectification (Art. 21-22)
`FADP-ART24`	Data Breach Notification (Art. 24)
`FADP-ART16`	Cross-Border Data Transfers (Art. 16-18)
`FADP-ART30`	Data Protection Impact Assessment (Art. 30-34)
`FADP-PROC-1`	Data Processing Agreements with Processors
`FADP-SEC-1`	Technical and Organisational Security Measures

Policy templates

Written for revFADP:

revFADP: Datenschutzerklärung / Privacy Notice
revFADP: Cross-Border Data Transfer Policy
revFADP: Data Breach Notification Procedure

And 22 from the standard set, adapted to revFADP.