Calibration 03 / data
The revised FADP is the Swiss starting point; GDPR may also matter depending on the facts. The project map records the actual processing and routes applicability and wording to the responsible adviser.
Record data categories, people, purposes, sources, systems, roles, access, vendors, locations, transfers, retention, backups, deletion, and any automated or AI-assisted use.
Assign notices, user requests, correction/deletion paths, permissions, processor instructions, transfer safeguards, incident escalation, logging, and security controls to named owners.
Engineering validates the approved behavior; the client/adviser approves legal interpretation. Recheck sources, vendors, and the release facts before claiming readiness.
Measure. Decide. Implement. Verify.