DPA Generator for CH

CH-specific obligations covered

The output is anchored on the regulations that apply to AI deployments in CH. The top frameworks cited:

• revFADP — Revised Federal Act on Data Protection (revFADP, SR 235.1), in force 1 September 2023legislation · In force

  Article 6 — Principles for data processing • Article 5(c) — Sensitive personal data (includes health, biometric data) • Article 21 — Automated individual decisions (right to request human review) • Article 22 — Data protection impact assessment

• Swiss MedDO — Swiss Medical Devices Ordinance (MedDO, SR 812.213)legislation · In force

  Healthcare — Switzerland uses mutual recognition with EU MDR/IVDR via MRA. Post-2024 CE marking is not automatically valid in Switzerland for new devices.

• FINMA Circular 2023/1 — Operational Risks and Resilience — Banks (RS 2023/1)regulatory_circular · In force

  FINMA-supervised institutions must identify, assess, and manage AI and ML model risks as part of their operational risk framework; maintain independent model validation processes; ensure board-level accountability for technology risks; and demonstrate adequate controls over AI systems used in credit decisions, trading, and customer-facing services.

• Federal Act on Financial Services (FinSA, SR 950.1)federal_legislation · In force

  Financial service providers using AI for client advisory, portfolio management, or investment recommendations must conduct a client suitability and appropriateness assessment, ensure AI-generated advice is explainable to clients, maintain adequate documentation of algorithmic decision logic, and provide clients with a key information document where required.

How the DPA Generator approaches this

You describe your organisation, the AI vendor (Processor), the AI service being procured, and the categories of personal data the service will process. The tool maps your jurisdiction + industry + risk appetite into a structured, schedule-based DPA ready to redline with your legal team.

The DPA follows the format working contract lawyers recognise — main clauses for the contractual body, schedules for the GDPR Art. 28(3) particulars (subject matter / duration / nature / purpose / data categories / data subject categories), schedules for the operational details (TOMs, sub-processors, transfer mechanism), and annexes for the AI-specific protections + negotiation positions + consolidated review-required notes. Risk-appetite-driven defaults (security standard, audit notice, breach window, liability cap, model-update notice) are internally consistent across clauses, schedules, and the negotiation checklist. This is an AI-assisted drafting aid intended to accelerate review by qualified data-protection counsel.

What you get

• ✓ Schedule-based GDPR Art.28(3) format that working contract lawyers recognise — main clauses + 4 schedules + 3 annexes + signature blocks, not a flat clause-list.
• ✓ Sub-Processor schedule pre-populated with typical sub-processors for the named vendor (e.g. Microsoft Azure for OpenAI services), with explicit ⚠️ verify callout — saves the customer and counsel hours of inferring the chain.
• ✓ Inline ⚖️ qualified-legal-review callouts at known risk points (security standard, breach notification window, audit cost allocation, IP ownership, training-data restrictions, AI-error liability cap), consolidated into Annex C with the specific counsel competence required for each.
• ✓ Risk-appetite-driven defaults are internally consistent — security standard, audit notice, breach window, liability cap, and model-update notice all reference the same risk-appetite-driven values across clauses, schedules, and the negotiation checklist.

Ready to generate?

$39 · one-time — answer a 6-question intake (including jurisdiction = CH), and download your tailored document immediately.

Also available framed for your sector → see industry-specific pages