Record of processing activities (nFADP): who needs one?

The record of processing activities required by the nFADP is a company's inventory of its personal data processing: which data, for what purpose, shared with whom, kept for how long. The revised Swiss Federal Act on Data Protection requires it in principle, with a significant exemption for SMEs.

Whether or not you are required to keep one, this inventory is useful: you can only protect well what you know. This article does not replace legal advice suited to your business.

Who must keep a record of processing activities?

Article 12 of the nFADP requires controllers and processors to keep a record. The Data Protection Ordinance (DPO) exempts companies with fewer than 250 employees on January 1 of a given year, as well as natural persons.

The exemption does not apply in two cases: when sensitive data is processed on a large scale, or when high-risk profiling is carried out. A company in the healthcare sector, for example, should therefore look at the question closely, even with few employees.

What does a record of processing activities contain?

For each processing activity, the controller's record states at a minimum:

• The identity of the controller.
• The purpose of the processing (payroll, invoicing, marketing, recruitment).
• The categories of data subjects and of personal data processed.
• The categories of recipients, including processors.
• Where possible, the retention period or the criteria for setting it.
• Where possible, a general description of the security measures.
• If data is disclosed abroad, the country concerned and the safeguards in place.

How to build and maintain the record

A spreadsheet is enough for an SME. Start from activities rather than software: payroll, invoicing, customer relations, recruitment, video surveillance, newsletter. One row per activity, one column per item.

The law requires the record to be kept up to date. Set a review date, for example once a year, and a habit: every new application, new provider or new use of data triggers an update. Name one person responsible for the document.

If you act as a processor for your own customers, your record is shorter: your identity and that of the controller, the categories of processing carried out on its behalf, the security measures and any disclosure abroad.

Record of processing and IT: how do they connect?

The record draws on IT, and vice versa. To fill it in, you need to know where the data is: business application, Microsoft 365, file shares, CRM, backups, cloud services. Your IT provider knows these locations and the security measures in place; it can help you describe these items, even though responsibility for the record remains yours.

In return, the record serves IT: it shows which data deserves the strongest protection, which access rights to grant, which retention periods to apply and which providers must sign a data processing agreement.

Common mistakes

A few pitfalls come up often in SME records:

• Listing software without describing purposes.
• Forgetting data outside applications: mailboxes, Excel files, scanned documents.
• Filling in the record once, then never opening it again.
• Leaving out processors and cloud services, even though they are among the recipients.
• Describing security measures in vague terms, unrelated to the tools actually in place.