Checklist: answering access requests under the Swiss FADP and GDPR
For: Data protection leads and customer service
Updated: 2026-11
An access request is answered in seven steps: record intake and start the deadline, check identity proportionately, clarify scope, search all systems for data, check restrictions, compile the response with the statutory content and deliver it securely and on time, with documentation.
Under Swiss law access must generally be provided free of charge within 30 days, under the GDPR within one month. The deadline is tight when personal data sits in many systems and nobody knows where.
This checklist describes the process for a single request. What an access response must contain is explained in the glossary entry on the right of access.
The checklist
- 01
Record intake and start the deadline
Record the request with its date of receipt, whatever the channel, and calculate the deadline.
Done when: The request has a number, a date of receipt and a deadline with an owner.
- 02
Check identity
Check the requester’s identity proportionately, without asking for more data than necessary.
Done when: Identity is established and the method documented; in case of doubt a follow-up question was asked.
- 03
Clarify scope
Clarify whether the person requests access to all data or to specific areas.
Done when: The scope is recorded in writing and follow-up questions are answered.
- 04
Search all systems
Search all systems using the data map or record of processing, including email, file storage and processors.
Done when: For each system it is documented whether data was found; processors have been asked.
- 05
Check restrictions
Check whether third-party interests, statutory secrecy or overriding own interests justify a restriction.
Done when: Every restriction is justified and documented; third-party data is redacted.
- 06
Compile the response
Prepare the response with the statutory content: data, purpose, retention period, source, recipients and transfers abroad.
Done when: The response contains all required information and has been checked by a second person.
- 07
Deliver securely and document
Deliver the response on time via a secure channel and close the case.
Done when: Delivery with date is proven and the request is filed with all steps.
Common mistakes
- —Counting the deadline from the start of processing rather than receipt.
- —Forgetting data held by processors and in mailboxes.
- —Disclosing third-party data without redaction.
- —Sending the response unencrypted by email to an unverified address.
What this checklist does not cover
- —The checklist does not replace legal assessment of restrictions in individual cases.
- —Sector-specific access duties, for example in healthcare, may go further.
- —Erasure and rectification requests involve additional steps.
Parent service: Data Protection Consulting
Matching offers
Automating data subject access requests
We build a process that lets your company answer access, rectification and erasure requests under the Swiss FADP and the GDPR on time and traceably: intake channel, identity check, a map of where personal data lives, automated queries via interfaces, response templates and a log per request. Legal assessment of individual cases stays with you or your law firm.
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
FAQ
May we charge for access?
Under Swiss law generally not. Only with disproportionate effort is a contribution of no more than CHF 300 permitted, after prior notice.
What if the deadline is not enough?
Inform the person before the deadline expires, stating when the response will follow.
Must copies of documents be provided?
The personal data as such must be provided. How depends on the case; a structured compilation is often sufficient.
More checklists
Checklist: rolling out Microsoft 365 Copilot safely
Copilot is rolled out safely in seven steps: clean up sharing and permissions, classify confidential data, set data loss rules, issue a usage policy, start with a pilot group and clear use cases, train users to check outputs and measure the benefit before expanding.
Checklist: does NIS2 apply to a Swiss company?
Whether NIS2 affects a Swiss company is clarified in seven steps: list EU entities, check their sectors and size, identify digital services in the EU, collect supply chain requirements from EU customers, map reporting duties, assign responsibility and document the result.
Checklist: carrying out a data protection impact assessment
A data protection impact assessment is produced in seven steps: check whether a high risk exists, describe the planned processing, assess risks to data subjects, define measures, judge the residual risk, consult the FDPIC or the data protection adviser if a high residual risk remains, and retain and update the assessment.