Swiss FADP Article 22: Data protection impact assessment

1 If processing is likely to result in a high risk to the data subject's personality or fundamental rights, the controller shall carry out a data protection impact assessment beforehand. If several similar processing procedures are planned, a joint assessment may be carried out.

2 The existence of a high risk, in particular when using new technologies, depends on the nature, extent, circumstances and purpose of the processing. A high risk arises in particular: (a) in the case of the large-scale processing of sensitive personal data; (b) if public areas are systematically monitored on a large scale.

3 The data protection impact assessment shall include a description of the planned processing, an evaluation of the risks to the data subject's personality or fundamental rights and a description of the measures to protect personality and fundamental rights.

4 Private controllers are exempt from having to carry out a data protection impact assessment if they are required by law to process the data.

5 A private controller may dispense with carrying out a data protection impact assessment if it uses a system, product or service that is certified under Article 13 for the intended use, or if it complies with a code of conduct under Article 11 that satisfies the following requirements: (a) The code of conduct is based on a data protection impact assessment. (b) It provides for measures to protect the personality and the data subject's fundamental rights. (c) It has been submitted to the FDPIC.