INTRA/CHSwitzerland
What the record establishes for Switzerland, measure by measure, and what each source requires of the measure it governs.
| Control | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|
| 9Mandatory | |||
| AW002/CHTransparency notice on what is observedMandatory | Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches. | The controller informs the person appropriately of the collection of personal data, whether or not collected from the person. The persons concerned are informed in advance and in detail of the type, aim, and purpose of the processing; an internal regulation sets out their rights and duties under monitoring and control systems and how the internal control is carried out; monitored areas are marked as such. A signed IT usage directive gives general notice that controls may occur; it does not inform of a covert method. |
| BA007/CHAutomated decision-making about a workerMandatory | Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026 | That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches. | The controller informs the person of a decision that rests on automated processing alone and carries a legal effect or affects them significantly. |
| CP004/CHReliance on material obtained in breachMandatory | BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026 | That covert spyware on an employee’s computer for three months, taking screenshots, is behaviour monitoring prohibited by article 26 ArGV 3 and disproportionate, that a signed IT usage directive gives general notice of controls and does not authorize it, that the lawful sequence is technical prevention, then anonymized analysis of logs, then named analysis of access logs on concrete suspicion of abuse, that the evidence so obtained is excluded because the employee’s personality interest outweighs the interest in the truth, and that the dismissal resting on it was annulled. | Evidence obtained by unlawful covert monitoring is excluded where the employee’s personality interest outweighs the interest in establishing the truth, and the employer’s interest in the truth did not outweigh it. |
| GV007/CHLawful basis registerMandatory | Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026 | That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches. | An infringement of personality is unlawful unless justified by the person’s consent, by an overriding private or public interest, or by law; processing is lawful, in good faith, proportionate, and for a purpose recognizable to the person. |
| GV008/CHImpact assessment before deploymentMandatory | Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches. | A prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights of the person. The business examines and justifies in writing the overriding interest and the proportionality of a planned monitoring or control system, and produces the justification to the cantonal labour inspectorate on request. |
| IR006/CHNotification to a supervisory authorityMandatory | Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026 | That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches. | A security breach likely to carry a high risk for the personality or fundamental rights of the person is notified to the EDÖB as fast as possible. |
| MD004/CHEndpoint activity monitoringMandatory | Verordnung 3 zum Arbeitsgesetz (ArGV 3), Artikel 26Federal Council · read 5 Oct 2026BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | That monitoring and control systems meant to monitor the behaviour of employees at the workplace may not be used, and that systems required for other reasons are designed and placed so that they do not impair the health and freedom of movement of employees. | Monitoring and control systems meant to monitor the behaviour of employees at the workplace may not be used. IT tools that monitor the computer or phone activity of employees at work or at home, email, spyware, activity trackers, app or web logs, mouse or keyboard logs among them, are behaviour monitoring systems. Spyware installed covertly on an employee’s computer for three months, taking screenshots, is behaviour monitoring prohibited by article 26 ArGV 3 and disproportionate. |
| MD016/CHMeasurement of pace and performanceMandatory | Verordnung 3 zum Arbeitsgesetz (ArGV 3), Artikel 26Federal Council · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | That monitoring and control systems meant to monitor the behaviour of employees at the workplace may not be used, and that systems required for other reasons are designed and placed so that they do not impair the health and freedom of movement of employees. | The prohibition reaches behaviour monitoring; a system required for other reasons, quality or performance monitoring among them, is designed so that it does not impair health or freedom of movement. Automatic registration of the number or quality of parts produced or of calls taken in a call centre is permitted performance monitoring, kept proportionate; where behaviour and performance cannot be separated, the overriding interest and proportionality are examined and justified in writing. |
| MD018/CHCovert monitoring on prior suspicionMandatory | BGE 139 II 7Bundesgericht, I. sozialrechtliche Abteilung · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026 | That covert spyware on an employee’s computer for three months, taking screenshots, is behaviour monitoring prohibited by article 26 ArGV 3 and disproportionate, that a signed IT usage directive gives general notice of controls and does not authorize it, that the lawful sequence is technical prevention, then anonymized analysis of logs, then named analysis of access logs on concrete suspicion of abuse, that the evidence so obtained is excluded because the employee’s personality interest outweighs the interest in the truth, and that the dismissal resting on it was annulled. | A signed IT usage directive gives general notice of controls and does not authorize covert spyware; the sequence is technical prevention, anonymized log analysis, then named analysis on concrete suspicion. The prosecution of offences inside the business is for the police and not for the business, and monitoring data collected impermissibly are mostly unusable in criminal proceedings. |