Ordinance on Data Protection Certification (DPCO)
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Art. 11 Suspension and withdrawal of certification
1 The certification body may suspend or withdraw certification, in particular if it establishes serious deficiencies in the course of an inspection. A serious shortcoming is constituted in particular where: a. essential requirements for data protection certification are no longer fulfilled; or b. a certificate is being used in a misleading or unlawful manner. 2 In the event of any dispute in relation to suspension or withdrawal, the assessment and the procedure for the case are governed by the provisions of civil law applicable to the contractual relationship between the certification body and the manufacturer of the data processing systems or programs, the controller or the processor who has obtained certification.
Art. 12 Procedure in the case of supervisory measures by the FDPIC
1 If the FDPIC establishes serious deficiencies in relation to a manufacturer of data processing systems or programs, a controller or a processor that has been certified, it shall notify the certification body. 2 The certification body shall immediately request the manufacturer of the data processing systems or programs, the controller or the processor to rectify the deficiency within 30 days of the certification body being notified by the FDPIC. 3 If the deficiency is not rectified within 30 days, the certification body shall suspend the certification. If there is no prospect of the lawful position being established or restored within a reasonable time, certification must be withdrawn. 4 If the deficiency is not rectified within the deadline under paragraph 2 and if the certification body has not suspended or withdrawn certification, the FDPIC shall take a measure under Article 51 paragraph 1 FADP. It may in particular order that certification be suspended or withdrawn. If it issues t