Assets & protection requirements
Where personal data is recorded.
FEATURES · DATA PROTECTION & DPIA
Data protection under the FADP, in the same system.
In the protection requirements analysis you record personal data and the characteristics of the processing. This shows whether a data protection impact assessment is required, and you create the DPIA right there, with approval by the data protection advisor.
WHAT YOU GET
- Personal data and sensitive personal data per piece of information
- Processing characteristics per system, e.g. profiling or disclosure abroad
- DPIA triggers under the FADP built in, can only be made stricter
- DPIA with risks, measures and a green, amber or red result
Personal data at system level
Information carries its data categories, systems the characteristics of the processing. That way it is clear for every system which personal data it processes and how.
- Personal data, sensitive personal data and data on criminal matters
- Profiling, automated individual decisions, monitoring, disclosure abroad
- Confirmation by the data protection advisor
Is a DPIA required?
Your entries produce a justified recommendation under the FADP. The statutory triggers are built in; your organisation can make them stricter but not weaker. Exemptions under the FADP are recorded with a justification.
- Private organisations and federal bodies
- Obligations from the Data Protection Ordinance as measures of the system
- Decision with justification in the system
DPIA directly in Varmo
The data protection impact assessment describes the risks to the people concerned, assesses them on your scale and defines measures. The result is shown as a traffic light. The data protection advisor approves the DPIA; alternatively, you can adopt an existing DPIA as a PDF.
- Risks with scenarios, each assessed
- Result green, amber or red
- Approval by the data protection advisor
Related
Public sector
The FADP for federal bodies and the ISA.
Frequently asked questions
When is a DPIA required?
Under Art. 22 FADP, when processing may result in a high risk to the personality or fundamental rights of the data subjects, for example with extensive processing of sensitive personal data or systematic monitoring of public areas. Varmo suggests the decision based on your entries; your organisation’s assessment is what counts.
Does this also cover the GDPR?
Varmo maps the Swiss FADP. If you are also subject to the GDPR, you can use the DPIA in Varmo as a basis, but you need to check the GDPR requirements yourself.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.