Who has to keep a record?
In Switzerland, controllers and processors each keep a record of their processing activities (Art. 12 para. 1 FADP). Under Art. 24 DPO, companies employing fewer than 250 people on 1 January of a given year, as well as natural persons, are exempt – unless they process sensitive personal data on a large scale or carry out high-risk profiling.
In the EU, Art. 30 GDPR applies. The exemption for companies with fewer than 250 employees (Art. 30 para. 5 GDPR) is narrow: it does not apply if the processing poses a risk, is not merely occasional or concerns special categories of data. Anyone who regularly processes customer or employee data is therefore generally obliged to keep a record. The EU intends to broaden this exemption; a corresponding amendment is going through the legislative process but is not yet in force (as of October 2026).
What goes into the record?
The FADP and the GDPR require almost the same information:
| Information | FADP (Art. 12 para. 2) | GDPR (Art. 30 para. 1) |
|---|---|---|
| Identity of the controller | yes | yes, with contact details and data protection officer |
| Purpose of processing | yes | yes |
| Categories of data subjects and personal data | yes | yes |
| Categories of recipients | yes | yes |
| Retention period or criteria for it | where possible | where possible |
| Description of security measures | where possible | where possible |
| Disclosure abroad, with country and safeguards | yes | yes |
Why does the record become outdated so quickly?
Many records are created once from interviews and questionnaires and then live on in a spreadsheet. New applications, cloud services and AI tools are added, exports are created, responsible persons change – and nobody updates the record.
On top of that, there is a second problem: the retention periods are listed in the record, but the systems still do not delete anything. The document then describes an order that does not exist in reality.
From an Excel list to a living record
A record stays up to date when it is connected to the systems rather than only to the people who maintain it:
- 1Keep track of systems with responsible persons, criticality and status.
- 2Reconcile findings from a technical search so that unknown storage locations also come to light.
- 3Have business owners confirm the locations of personal data.
- 4Approve retention periods with justification and legal basis under the four-eyes principle.
- 5Hand over approved retention periods for deletion so that they apply in the systems.
- 6Make gaps visible: systems without responsible persons, unconfirmed entries, retention periods without a basis.