Processing regulations for federal bodies

Article 6

The responsible federal body and its processor must issue processing regulations for automated processing if they:
- a. process sensitive personal data;
- b. carry out profiling;
- c. process personal data in accordance with Article 34 paragraph 2 letter c FADP;
- d. allow cantons, foreign authorities, international organisations or private persons access to personal data;
- e. link data collections with each other; or
- f. operate an information system or manage data collections with other federal authorities.
The regulations must in particular include details of the internal organisational structure, data processing and control procedures, and the measures that guarantee data security.
The responsible federal body and its processor must update the regulations regularly and make them available to the data protection officer.

Take a Brighter Approach to Privacy, AI, and Digital Governance Compliance