Data Protection Ordinance (DPO)
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Art. 13 Modalities of the duty to provide information
The controller must provide the data subject with information on the collection of personal data in a precise, transparent, comprehensible and easily accessible form.
Art. 14 Retention of the data protection impact assessment
The controller must retain the data protection impact assessment after concluding the data processing for a minimum of two years.
Art. 15 Report of breaches of data security
1 The report to the FDPIC of a breach of data security must include the following information: a. the form of breach; b. the time and duration, if possible; c. the categories and approximate amount of personal data concerned, if possible; d. the categories and the approximate number of data subjects, if possible; e. the consequences, including any risks, for the data subjects; f. the measures that have been taken or are planned in order to remedy the breach and mitigate the consequences, including any risks; g. the name and the contact details of a contact person. 2 If the controller is unable to report all the details at one time, it shall supply the missing details as quickly as possible. 3 If the controller is required to inform the data subject, it shall provide the data subject with the details specified in paragraph 1 letters a and e–g in simple and comprehensible language. 4 The controller must document the breaches. The documentation must contain a summary of the circumstances