Legal support for data protection projects: tasks, roles and phases

Short answer: The legal side of a data protection project usually covers five tasks: the record of processing activities (Art. 12 of the Swiss Data Protection Act, DSG; Art. 30 GDPR), data protection impact assessments where risk is high (Art. 22 DSG, Art. 35 GDPR), contracts with processors (Art. 9 DSG, Art. 28 GDPR), transfers abroad (Art. 16 et seq. DSG, Art. 44 et seq. GDPR), and processes for data subject requests and data breaches. Data protection lawyers assess legal bases, risks and contracts; privacy analysts map data and processes. A formally appointed data protection officer or Swiss data protection adviser is a separate role.

This guide is for general counsel, data protection leads and project managers in Switzerland and Germany who are setting up or catching up on a GDPR or revised Swiss DSG (revDSG) programme. It covers the typical legal tasks in a data protection project, the roles, a phased approach and the GDPR–revDSG differences that drive effort.

Typical tasks in a data protection project

Most data protection projects consist of five workstreams, each with a clear deliverable and a matching profile. The table gives the overview; the sections below cite the provisions.

Record of processing activities

Controllers and processors must keep a record under both regimes. Under Art. 12(2) DSG it contains at least the controller's identity, the purpose, the categories of data subjects and data, the recipients, where possible the retention period and security measures, and, for transfers abroad, the country and the safeguards. In Switzerland, companies with fewer than 250 employees are exempt if their processing poses a low risk (Art. 12(5) DSG). The GDPR has its own exemption in Art. 30(5).

Data protection impact assessment

A DPIA is required in advance where processing is likely to result in a high risk for the people concerned, in particular when new technologies are used (Art. 22 DSG, Art. 35 GDPR). It describes the processing, assesses the risks and sets out measures. If a high risk remains despite the measures, the controller must consult the Swiss Federal Data Protection and Information Commissioner (FDPIC, Art. 23 DSG) or the supervisory authority (Art. 36 GDPR) beforehand.

Processors

Controllers that use service providers assign the processing by contract or by law and must satisfy themselves that the provider can ensure data security; sub-processors need prior approval (Art. 9 DSG). The GDPR additionally prescribes mandatory content for the contract, such as acting only on documented instructions and confidentiality (Art. 28(3) GDPR).

Transfers abroad

Personal data may be disclosed from Switzerland to countries whose legislation the Federal Council has found to provide adequate protection; otherwise, safeguards such as standard contractual clauses approved or recognised by the FDPIC are needed (Art. 16(2) DSG). Since 15 September 2024, the United States has been treated as adequate for companies certified under the Swiss-US Data Privacy Framework. In the EU, Chapter V of the GDPR (Art. 44 et seq.) governs transfers to third countries.

Data subject requests and breaches

In Switzerland, access requests must usually be answered within 30 days and free of charge (Art. 25(6) and (7) DSG); under the GDPR within one month, extendable by two months (Art. 12(3) GDPR). Under the GDPR, controllers report breaches to the supervisory authority within 72 hours (Art. 33); under the DSG they report to the FDPIC as soon as possible, and only where a high risk is likely (Art. 24).

Roles: data protection lawyer, privacy analyst, DPO or data protection adviser

A data protection project needs legal and operational roles; the formally appointed data protection function advises and monitors but does not replace the project team.

• Data protection lawyer: legal bases, balancing of interests, DPIA assessment, contracts, transfers, policies and privacy notices.
• Privacy analyst or data protection coordinator: interviews with business units, data inventory, maintaining the record, templates and deadline tracking.
• Information security and IT: technical and organisational security measures (Art. 8 DSG, Art. 32 GDPR).
• Data protection officer (Germany) or data protection adviser (Switzerland): a formal role under Art. 37–39 GDPR and section 38 of the Federal Data Protection Act (BDSG), or a voluntary role under Art. 10 DSG. When carrying out a DPIA, the controller seeks the advice of the DPO (Art. 35(2) GDPR).

Project support does not automatically replace a data protection officer. Operational work and an appointed function are different roles. Clarify which activity is needed, which qualification it requires and which responsibility stays in-house. What applies when the role falls vacant is covered in data protection officer vacancy and interim appointment.

Alpinum Solutions provides data protection lawyers and privacy analysts through staff leasing (Personalverleih in Switzerland, Arbeitnehmerüberlassung in Germany) or freelancing, in Switzerland and Germany, part time or full time, individually or as a project team. The client steers the assignment: in staff leasing it gives the professional instructions; in freelancing the professional works independently within the agreed mandate.

A data protection project in phases

A data protection project runs through six phases that partly overlap.

1. Define the scope: entities, countries, systems, target dates and the internal subject-matter lead. Capture the backlog with deadlines and internal owners.
2. Map the current state: record processing per business unit, identify processors and transfers abroad. Separate recurring document work from complex individual questions.
3. Assess: check legal bases, transparency duties, DPIA needs and transfer safeguards; prioritise gaps.
4. Implement: complete the record, renegotiate contracts, update privacy notices, carry out DPIAs. Keep templates, review criteria and past decisions in one place.
5. Embed processes: introduce procedures for access requests, breaches and new processing; organise queries to business units and internal sign-offs on a binding basis.
6. Train and hand over: document results with sources, status and open points so that the internal team can continue the work.

What belongs in the brief

A good brief describes the specific documents and processes, the countries, languages and systems involved, target dates and the internal subject-matter lead. Anonymised volume and complexity indicators, such as the number of business units, vendors and countries, help with estimating effort. A template is available in how to brief an interim lawyer.

GDPR and revDSG differences that shape the project

The revised DSG has been in force since 1 September 2023 and follows the GDPR on many points. Some differences, however, change the scope and priorities of a project:

• Terminology: the DSG speaks of "Bearbeitung" (processing) and "besonders schützenswerte Personendaten" (sensitive personal data); the GDPR of processing and special categories of personal data.
• Sanctions: the GDPR provides for fines against companies of up to EUR 20 million or 4% of worldwide annual turnover. The DSG provides for fines of up to CHF 250,000, which are generally imposed on the responsible individuals. Training for managers is therefore a high priority in Switzerland.
• Breaches: 72 hours under the GDPR, compared with "as soon as possible", and only where a high risk is likely, under the DSG.
• Data protection function: in Germany, a DPO is mandatory where, as a rule, at least 20 people are constantly engaged in automated processing (section 38 BDSG, as of October 2026). In Switzerland, the data protection adviser is voluntary (Art. 10 DSG).
• Access requests: 30 days under the DSG, one month under the GDPR.
• Representatives: foreign controllers need a representative in Switzerland (Art. 14 DSG) or in the EU (Art. 27 GDPR) under certain conditions.

Companies active in both markets usually build their programme on the stricter standard and add the Swiss specifics. A detailed comparison is in GDPR vs the Swiss FADP. New products and AI features need additional checks, described in data protection for product launches.

Limits and risks

• Responsibility stays with the company: the company is the controller under the DSG and the GDPR. External professionals prepare and implement; the company decides.
• No legal advice: Alpinum is not a law firm. Proceedings before authorities or courts may require external counsel.
• Keep the formal role separate: if a professional is also to become DPO or data protection adviser, independence and conflicts of interest must be checked beforehand.
• Limit access: project staff often see sensitive data. Grant and document access on a need-to-know basis.
• No project without operations: a record without a maintenance process quickly goes out of date. Post-project responsibilities belong in the handover.

Frequently asked questions about data protection projects

Does a data protection project need lawyers?

Not necessarily for mapping data and processes, but yes for assessing them. Legal bases, balancing of interests, DPIAs, processor contracts and international transfers call for legal judgement. A practical set-up is a tandem: privacy analysts map and document, while data protection lawyers review, decide on escalations and draft contracts and policies.

How long does a record of processing activities take?

There is no fixed duration. Effort depends on the number of entities, business units, systems and vendors and on how available the business contacts are. A pilot with one business unit gives a reliable estimate for the rest. Afterwards, the record needs a fixed maintenance process so that it stays current.

Does every company in Switzerland need a record of processing?

In principle, yes. Art. 12 DSG requires controllers and processors to keep a record. Companies with fewer than 250 employees are exempt if their processing poses a low risk of harm to the people concerned (Art. 12(5) DSG, detailed in the Data Protection Ordinance). Companies that process sensitive data on a large scale should assume the duty applies.

Does a project team replace the data protection officer?

No. The DPO under the GDPR and the BDSG is an appointed function with its own status: the DPO receives no instructions on how to carry out the tasks and reports to the highest management level (Art. 38 GDPR). A project team works on the company's behalf. The two can be combined if roles and conflicts of interest are clearly settled.

Who is fined for data protection breaches in Switzerland?

Under the DSG, fines of up to CHF 250,000 are generally imposed on the responsible individuals, not on the company (Art. 60–63 DSG). In the EU, fines under Art. 83 GDPR are imposed on the company, up to EUR 20 million or 4% of worldwide annual turnover. Clear responsibilities and training are therefore especially important in Swiss projects.

Next step

If a GDPR or revDSG project needs extra capacity, Alpinum provides data protection lawyers, privacy analysts and project teams. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the client and Alpinum.

• Data privacy and IT law project lawyers
• GDPR vs the Swiss FADP
• Data protection officer vacancy and interim appointment
• Discuss your requirements

Last updated: 30 October 2026.