Privacy review before a product launch

By Christian Steinmetz and Maren Siegels

Short answer: Before launching a digital product, a company should check at least seven data protection points: data protection by design and by default (Art. 7 of the Swiss Data Protection Act, DSG; Art. 25 GDPR), purpose and legal basis, information for users (Art. 19 DSG, Art. 13 GDPR), whether a data protection impact assessment is needed because of high risk (Art. 22 DSG, Art. 35 GDPR), processors, transfers abroad and the entry in the record of processing. If the product includes AI features, the transparency duties in Art. 50 of the EU AI Act, which have applied since 2 August 2026, come on top.

This guide is for product owners, legal counsel, data protection leads and CTOs in Switzerland and Germany. It shows how privacy by design fits into the product process, which pre-launch checks a privacy review should cover, what AI features add and how much capacity the work needs.

Privacy by design in the product process

Privacy by design is mandatory under both regimes: the controller must design processing technically and organisationally so that data protection rules are met, and must take this into account from the planning stage (Art. 7(1) DSG). The GDPR requires appropriate measures as early as the time the means of processing are determined (Art. 25(1) GDPR). Privacy by default comes on top: without user action, only the data necessary for the purpose is processed (Art. 7(3) DSG, Art. 25(2) GDPR).

In practice, privacy is not checked at the end but at fixed decision points in the product process. The table maps each product phase to a data protection task and a deliverable.

Product phase	Data protection task	Deliverable
Idea and discovery	Clarify purpose, target users and data categories; identify sensitive data	Short privacy screening with an initial risk view
Concept and design	Build data minimisation, defaults, retention and user rights into the design	Data flow diagram, decision on a DPIA
Procurement	Review cloud and software vendors, clarify processor status and transfers abroad	Reviewed contracts, transfer map
Build	Implement technical and organisational measures, logging and deletion	Security and deletion features in place
Test and beta	Use synthetic or anonymised data where possible; with real users, provide information and a legal basis	Approved test concept
Pre-launch	Finalise privacy notice, consents and DPIA, update the record, check AI transparency	Privacy sign-off with open points
Operation and changes	Screen new features, handle data subject requests and breaches	Updated documentation, change log

How to structure legal support

Map project phases and legal decision points.
Organise contract documents, service descriptions and open negotiation points.
Name the interfaces with IT, procurement, information security and data protection.
Set approvals and escalation routes for deviations from the standard.
Record changes and decisions as you go.

Privacy review checklist before a product launch

Before go-live, each of the following points should be closed or consciously accepted as a residual risk:

Purpose and principles: purpose defined and recognisable for users, processing proportionate, deletion once the purpose is achieved (Art. 6 DSG); legal basis under Art. 6 GDPR identified.
Consent: where consent is required, it must be explicit for sensitive personal data and for high-risk profiling (Art. 6(7) DSG).
Information: privacy notice with the controller's identity, purpose, recipients and, where relevant, destination countries and safeguards (Art. 19 DSG, Art. 13 GDPR).
Defaults: data-minimising default settings, no automatic sharing with an indefinite number of people.
DPIA: screening documented; where high risk is likely, DPIA completed.
Vendors: processor contracts reviewed (Art. 9 DSG, Art. 28 GDPR).
Transfers: transfers abroad identified and safeguarded (Art. 16 DSG, Art. 44 et seq. GDPR).
Automated decisions: information and the option of review by a human (Art. 21 DSG, Art. 22 GDPR).
Security: measures appropriate to the risk (Art. 8 DSG, Art. 32 GDPR).
Record of processing: new processing added (Art. 12 DSG, Art. 30 GDPR).
Data subject rights: access and deletion technically possible; in Switzerland, access requests are usually answered within 30 days (Art. 25(7) DSG).
Cookies and tracking: in Germany, storing information on or accessing a user's device requires consent unless strictly necessary for a service the user has expressly requested (section 25 TDDDG, the German telecommunications and digital services data protection act). In Switzerland, users must be told about the processing and its purpose and that they can refuse it (Art. 45c of the Telecommunications Act, FMG).

AI features: additional duties under the AI Act

If a product has AI features, the duties of the EU AI Act (Regulation (EU) 2024/1689) apply alongside data protection law. They depend on the company's role and the system's risk.

Transparency (Art. 50, since 2 August 2026): providers design systems that interact directly with people so that users know they are dealing with AI. Synthetic content must be marked in a machine-readable format; for generative systems placed on the market before 2 August 2026, this marking duty applies from 2 December 2026. Deployers disclose deepfakes and inform people about emotion recognition and biometric categorisation.
Prohibited practices (Art. 5): in force since 2 February 2025; two new prohibitions on non-consensual intimate deepfakes and child sexual abuse material apply from 2 December 2026.
High-risk systems: for systems listed in Annex III, such as candidate selection, creditworthiness assessment or pricing in life and health insurance, obligations apply from 2 December 2027.
Clarify your role: a company that develops or has developed an AI system, including one built on a third-party AI model, and places it on the market or puts it into service under its own name or trademark is the provider of that system (Art. 3(3) AI Act). The model provider's own obligations remain separate.
Data protection still applies: for deployers of high-risk systems, Art. 26(9) AI Act expressly refers to the DPIA under Art. 35 GDPR. In Switzerland, using new technologies triggers the DPIA check under Art. 22 DSG.

The AI Act also covers companies outside the EU if they place AI systems on the EU market or the system's output is used in the EU (Art. 2(1) AI Act). How companies organise roles, inventory and AI literacy is covered in setting up AI governance; the deadlines are summarised in AI Act deadlines and capacity.

Roles and capacity in a launch project

A product launch needs a legal counterpart who works at the product team's pace, and clear responsibility for sign-off.

Product or privacy counsel: screening, DPIA, privacy notice, contracts, AI classification, sign-off paper.
Privacy analyst: data flows, record of processing, deletion concept, deadlines and documentation.
Information security: technical measures, testing, logging.
Data protection officer or Swiss data protection adviser: advises and monitors, especially on the DPIA (Art. 35(2), Art. 39 GDPR; Art. 10 DSG).

What belongs in the brief

A brief describes the product goal, vendor structure, contract types, languages, countries involved and the next milestones. It names the specific activity needed: document review, negotiation support, project coordination or individual legal questions. "Data protection" or "IT law" alone is too vague to select the right professional. The handover should include a current issues log with owners, deadlines and decision status, plus open commitments, not just the latest version of the privacy notice.

Alpinum Solutions provides data protection and IT lawyers and privacy analysts through staff leasing (Personalverleih in Switzerland, Arbeitnehmerüberlassung in Germany) or freelancing, in Switzerland and Germany, part time or full time. The client steers the assignment: in staff leasing it gives the professional instructions; in freelancing the professional works independently within the agreed mandate. The basics of records, DPIAs and processors are covered in legal support for data protection projects.

Limits and risks

Sign-off stays with the company: the company, as controller, approves the launch. External professionals prepare the decision.
No legal advice: Alpinum is not a law firm. Proceedings with authorities or contested interpretation questions may require external counsel.
Time pressure: if privacy is only checked just before go-live, there is no time for design changes or for consulting the authority. The FDPIC has two months to raise objections (Art. 23(2) DSG), a GDPR supervisory authority up to eight weeks (Art. 36(2) GDPR).
Document residual risks: risks that are consciously accepted belong in the records, with reasons and the decision-maker.

Frequently asked questions about data protection for product launches

When is a data protection impact assessment required?

A DPIA is required in advance where processing is likely to result in a high risk for the people concerned, especially when new technologies are used (Art. 22 DSG, Art. 35 GDPR). Typical triggers are large-scale processing of sensitive data, systematic monitoring of public areas and, under the GDPR, automated evaluations with legal effects.

Who signs off the launch from a data protection perspective?

The company, as controller, gives the sign-off, usually through a role defined in its internal process, such as the product owner with legal's approval. The data protection officer advises and monitors but does not approve in place of the company (Art. 39 GDPR). In Switzerland, consulting the data protection adviser can replace consulting the FDPIC (Art. 23(4) DSG).

Must an authority be consulted before launch?

Only if the DPIA shows that a high risk remains despite the measures. In that case, the FDPIC (Art. 23 DSG) or the GDPR supervisory authority (Art. 36 GDPR) must be consulted in advance. In Switzerland, this duty falls away if an independent data protection adviser was consulted and the conditions in Art. 10(3) DSG are met.

Does the AI Act apply to a product from Switzerland?

Yes, if the company places the AI system on the market or puts it into service in the EU, or if the system's output is used in the EU (Art. 2(1)(a) and (c) AI Act). Being based in Switzerland does not exempt a company from these duties, such as the Art. 50 transparency duties that have applied since 2 August 2026.

What applies to beta tests with real user data?

Tests are subject to the same rules as live operation: information for users, a legal basis, data security and proportionality. Where possible, tests should use synthetic or anonymised data. Real data from tests must be deleted or anonymised once it is no longer needed for the purpose (Art. 6(4) DSG).

Next step

If a product launch needs data protection or IT law capacity at short notice, Alpinum provides experienced lawyers and privacy analysts. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the client and Alpinum.

Last updated: 30 October 2026.

Data protection for product launches: legal capacity for privacy by design