Data protection & DPIA
Processing activities, FADP obligations and impact assessment.
SWISS FRAMEWORKS · DATA SECURITY FADP/DPO
Data security under the FADP and DPO.
The Swiss Federal Act on Data Protection requires data security appropriate to the risk (Art. 8 FADP); the Data Protection Ordinance sets out what that means. Varmo includes Art. 1–6 DPO as a framework and links it with the protection requirements analysis of your systems.
Platform framework from the Pro plan, for organisations subject to the Swiss Federal Act on Data Protection
Scope
25 requirements from Art. 1–6 DPO: principles and protection goals (Art. 1 and 2), data security measures (Art. 3), logging (Art. 4) and the processing regulations (Art. 5 and 6).
- Wording of the ordinance for each requirement
- Summary and practical implementation guidance
- Art. 4 in the version applicable since 1 December 2025
No fixed measures
The DPO does not prescribe fixed technical and organisational measures. It requires measures appropriate to the protection requirements and the risk so that the protection goals are achieved. The examples in the implementation guidance are suggestions, not obligations.
Depending on the type of organisation
Art. 4 para. 1 and Art. 5 apply to private organisations, Art. 4 para. 2 and Art. 6 to federal bodies. Varmo automatically sets the requirements that do not match your type of organisation to not applicable, with a justification. Whether an obligation applies to a system follows from its protection requirements analysis; the measure created there is linked with the requirement.
Mappings
The framework is mapped to ISO/IEC 27001 Annex A and NIST CSF 2.0. This shows which of your requirements support a goal of the DPO. Because the DPO only covers personal data and has its own criteria, a requirement does not automatically count as fulfilled through the mapping. Mappings and coverage are included from the Pro plan.
Related
ISO/IEC 27001:2022
Annex A as a framework, with the Statement of Applicability.
Frequently asked questions
Who is the framework for?
Organisations subject to the Swiss Federal Act on Data Protection, private organisations and federal bodies alike. Varmo offers the framework as soon as your organisation has specified the Swiss FADP and its type of organisation in the data protection settings.
Does the framework replace the data protection impact assessment?
No. The framework covers data security. You carry out the data protection impact assessment in Varmo on the protection object.
FREE · ABOUT 5 MINUTES
How far along is your ISMS? Take the ISO 27001 self-assessment.
A traffic light per clause, your next steps and the right plan. No sign-up; your answers stay in your browser.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.