Data protection does not start with the privacy notice but with knowing what happens to personal data in the company. The record of processing activities captures exactly that. The GDPR calls it the record of processing activities; the Swiss FADP uses an equivalent term.
What goes into it
Under Article 12 of the revised FADP, the controller’s record contains at least: the controller’s identity, the purpose of processing, a description of the categories of data subjects and personal data, the categories of recipients, where possible the retention period or the criteria for determining it, where possible a general description of security measures, and for disclosures abroad the state and the safeguards. Processors keep their own, leaner record. The GDPR requires comparable content in Article 30.
Who is exempt
In Switzerland, companies employing fewer than 250 people on 1 January of a year are exempt, unless they process sensitive personal data on a large scale or carry out high-risk profiling (Art. 24 Data Protection Ordinance). The GDPR has a similar exemption for companies under 250 employees, but it is narrow: it falls away as soon as processing is not occasional, which is practically always the case for customer and employee data.
Why it pays even without a duty
Without an overview the other duties can hardly be met. A correct privacy notice presupposes knowing purposes and recipients. A data subject access request can only be answered if you know where data sits. A data breach can only be assessed if it is known which data a system contains. The record is therefore the backbone, even where it is not formally required.
How to keep it pragmatically
Not as a legal document but as a working list per processing activity: website contact form, customer management, accounting, HR administration, newsletter, applications, support. For each line: purpose, data categories, systems and processors, recipients, foreign link, deletion rule and security measures. A spreadsheet is enough to start; more important than the tool is that someone keeps it current when a new tool is introduced.
Typical gaps
Forgotten tools introduced by individual teams. Foreign links via sub-processors of cloud services. Missing deletion rules. And a record created at project close and never opened again. Our revFADP checklist for SMEs therefore starts with mapping data flows.