The record of processing activities documents which personal data your organisation processes and for what purpose: under Art. 12 FADP and, if your organisation has selected the GDPR, under Art. 30 GDPR. You find it under Data protection › Record of processing. Varmo suggests details from your assets; only what you accept is saved. This article is for ISMS managers, the data protection advisor and everyone who keeps the record.

Before you start

  • People with the right View the record of processing activities can read the record; people with Keep the record of processing activities can keep it. New organisations give both to the functional roles ISMS manager and Data protection advisor. Owners of a process see the entries anchored to their process.
  • You define which laws apply and the type of your organisation under ISMS settings › Assets › Protection requirements assessment in the Data protection section. This determines under which laws you keep records and which check of the obligation applies.
  • The record is included in all plans.
  1. Keep the recordCheck obligation

    For each law, with suggestions from the assessments.

  2. Keep the recordRecord entries

    Create from processes and complete.

  3. Data protectionApprove (optional)

    Never the person who submitted.

Federal body

Processing as a federal body is also notified in DataReg; you record the status in the entry.

From process to approved record

First you check for each law whether your organisation must keep a record. Then you enter the controller details and the processing activities, most easily from your processes with personal data. Varmo shows missing details for each entry. Optionally, you submit the complete record as a version; confirmation by data protection approves it.

How to check the obligation

Under Obligation to keep a record you answer the exemption questions for each law. Varmo suggests “Yes” if an approved protection requirements assessment indicates it, for example for sensitive personal data. If you deviate from the suggestion, give a reason. A check cannot be changed; you check again when needed.

  • Under the FADP (Art. 24 DPO): companies and other private-law organisations with fewer than 250 employees on 1 January are exempt unless they process sensitive personal data on a large scale or carry out high-risk profiling. The check applies to the current year.
  • Under the GDPR (Art. 30(5) GDPR): organisations with fewer than 250 employees are exempt unless a processing is likely to result in a risk, is not occasional or includes special categories or data relating to criminal offences. If so, the obligation applies to these processing activities. Regular processing such as payroll is not occasional, so only few organisations are exempt. The check is valid for one year.
  • Federal bodies are never exempt. Cantons and municipalities do not check under Art. 24 DPO; cantonal law applies to them, and the record serves as a template.

How to record the entries

  1. Under Controller details, enter the address and, if the GDPR applies, the contact details. State whether your organisation processes personal data on behalf of others; you then keep entries as a processor for this.
  2. Choose Create from processes: for each selected information or process with personal data, an entry is created with the name, the purpose from the description and the linked assets. Or record a single entry with Record processing activity.
  3. In the entry, add the data subjects, the categories of personal data, the recipients, the retention, the data security measures and the disclosure abroad with the safeguard for each state. You accept suggestions from the linked assets with Use suggestion.
  4. Varmo shows for each entry under Still open which required details are missing.

Export and approval

  • Under Record under the FADP or under the GDPR you open the print view (as a PDF via Print) and the CSV file for each law.
  • Optionally, you submit the complete record as a version with Submit for approval. Confirmation by data protection approves it or rejects it with a reason. The person who submitted never approves. The export shows the status of the latest approved version.

Federal bodies: DataReg

Federal bodies notify their processing activities to the FDPIC via DataReg. Varmo does not transmit anything to DataReg. In the entry, you record the phase, the date of notification and the register number under DataReg. Details for DataReg shows the fields in the order of the entry form for copying. If you change the entry later, you receive the task Update the notification in DataReg.

Frequently asked questions

Does an exempt organisation have to keep a record?

No. A record still helps with access requests and audits; you can keep it voluntarily.

What applies to a private organisation with public tasks of the Confederation?

Record mixed processing as two entries, one for the private activity and one for the federal task. The obligations of federal bodies apply to the federal task: legal basis and notification in DataReg.