¶¶Òõ¶ÌÊÓƵ

A Data Privacy Addendum is essential for organizations engaging in personal data processing activities under Swiss jurisdiction. This document supplements existing service agreements or contracts where one party processes personal data on behalf of another, establishing clear protocols for data handling, security measures, and compliance requirements. It is specifically designed to meet the requirements of Swiss data protection laws, including the revised Federal Data Protection Act (revFADP/nDSG), while maintaining alignment with EU GDPR standards where relevant. The addendum becomes particularly crucial when Swiss organizations process data across borders or when international organizations process data in Switzerland, requiring careful consideration of both local and international data protection requirements. It includes detailed provisions for technical and organizational measures, breach notification procedures, and data subject rights, making it an essential tool for ensuring compliant data processing operations.

1. Parties: Identification of the data controller and data processor, including their registered addresses and authorized representatives

2. Background: Context of the data processing relationship, reference to the main agreement, and purpose of this addendum

3. Definitions: Key terms used in the agreement, including those from FADP/revFADP and, where relevant, GDPR

4. Scope and Purpose of Processing: Detailed description of the permitted data processing activities, categories of data subjects, and types of personal data

5. Obligations of the Processor: Core responsibilities of the processor including processing only on documented instructions, maintaining confidentiality, and implementing security measures

6. Technical and Organizational Measures: Security measures required to ensure appropriate level of data protection

7. Sub-processing: Conditions and requirements for engaging sub-processors, including authorization process and obligations

8. Data Subject Rights: Procedures for assisting the controller in responding to data subject requests

9. Personal Data Breaches: Notification requirements and procedures in case of data breaches

10. Data Protection Impact Assessments: Processor's obligation to assist with impact assessments and prior consultations

11. Return or Deletion of Data: Requirements for handling personal data upon termination of services

12. Audit Rights: Controller's rights to audit and processor's obligations to demonstrate compliance

13. Governing Law and Jurisdiction: Specification of Swiss law as governing law and jurisdiction for disputes