Record of Processing Activities (Bearbeitungsverzeichnis)
A Bearbeitungsverzeichnis is your written record of every way you process employee and candidate data—how you collect it, where you store it, who accesses it, how long you keep it. Swiss law (revDSG) requires most employers to keep one. It's your proof that you respect data protection rules and handle personal information responsibly.
The Bearbeitungsverzeichnis (record of processing activities) is a mandatory inventory under Swiss data protection law. It documents every instance where your company collects, stores, uses or deletes personal data about employees and job candidates.
You don't need an expensive template. A simple spreadsheet or document listing each data flow is enough. What matters is honesty: if you collect payroll data, store CVs, track work hours, or run background checks, those go in the register.
When you need one and what to include
Under the revised Federal Data Protection Act (revDSG), employers processing personal data must maintain a Bearbeitungsverzeichnis unless you're a micro-employer with very limited data handling. Most SMEs in Switzerland meet the threshold.
Your register should list: data types collected (name, salary, email), purpose (payroll, recruitment, performance), storage location (server, cloud service), retention period, and who can access it. Include contractor and vendor data flows too—recruitment agencies, payroll processors, cloud storage providers.
- Employee data: payroll, working hours, absence records, performance files
- Candidate data: CVs, application forms, interview notes, references
- Third parties: recruitment consultants, background-check providers, pension administrators
- Retention rules: how long you keep each category (employment contract copies five years; rejected CVs typically three months)
- Access controls: who in your company can see what data
- Technical measures: encryption, password protection, data backup location
Your employer obligation
Maintaining a Bearbeitungsverzeichnis is not optional under revDSG—it's a legal requirement for most employers. It demonstrates due diligence to regulators and protects you if an employee or candidate raises a data protection complaint.
You're responsible for keeping it current. When you start using a new payroll system, hire a recruitment agency, or change where you store files, update the register within weeks. A stale register is almost as risky as having none at all.
- Create it before you're audited—don't wait for a complaint
- Review it annually and update when processes change
- Keep it accessible to your team (not locked in a drawer)
- Be honest about what you actually do, not what you think you should do
- Document any data security incidents you've had
- If a canton or EDÖB asks, you must provide it quickly
The most common mistake
Most SME employers treat the Bearbeitungsverzeichnis as a one-time compliance box to tick. They create it, file it away, and never look at it again. Then six months later they hire a new recruiter or switch to a cloud-based HR system and forget to update the register.
The second mistake is being vague. "We keep employee data" is not enough. Name the specific types, the systems where they live, the people who access them, and how long they stay. Vagueness suggests you don't actually know what you're doing with the data—which regulators notice.
- Outdated register that doesn't match your actual practices
- Forgetting to list external partners (payroll firm, recruitment consultant)
- No retention dates—saying 'we keep it as long as needed' without specifics
- Missing technical safeguards (encryption, backups, disaster recovery)
- Creating it in English when your company operates in German or French
- Assuming it's only needed for large employers—SMEs are equally bound
Frequently asked questions
- Do I really need a Bearbeitungsverzeichnis if I'm a small team of five people?
- Yes, almost certainly. Even small employers process payroll data, store CVs, and handle absence records. The revDSG applies to you unless you're genuinely tiny and process data only incidentally. If in doubt, consult the EDÖB guidance or a data protection lawyer. A simple register costs nothing; a fine for non-compliance costs far more.
- Can I use a template I found online?
- Templates are a helpful starting point, but they must fit your actual business. A generic template for a retail chain won't match a consulting firm's data flows. Use it as a checklist, then customize it to describe what *you* actually do with employee and candidate data.
- If I use a recruitment agency, do I list their data processing too?
- Yes. When a recruiter handles CVs or background checks on your behalf, that's part of your data ecosystem. Document what data you send them, where they store it, and how long they keep it. Your contract with them should spell this out; your register should summarize it.
General information for Swiss employers, not legal advice. Have a lawyer confirm anything with legal consequences.