The external Data Protection Advisor for pension funds

Philipp Rosenauer
Partner Legal, PwC Switzerland

In one of our recent blog posts, we described the impact of the revised Data Protection Act on federal bodies. Pension funds in the compulsory sector pursuant to the Federal Law on Occupational Retirement, Survivors’ and Disability Pension Plans qualify as so-called federal bodies in particular.

A significant tightening of the regulations compared to those for private companies therefore obliges pension funds to appoint an official Data Protection Advisor. This is often difficult, because pension funds are micro-organisations and there are often no resources available internally.

One option is to appoint an external Data Protection Advisor, who handles the following tasks in particular:

carrying out data protection impact assessments
reviewing and updating the register of processing activities
responding to data subject requests (e.g. right to information, right to data portability, right to erasure, etc.)
giving ad-hoc advice on data protection law/general interpretation of data protection law
drafting data processing contracts/agreements with third parties
checking and commenting on whether policies/procedures/information letters need to be updated so that the pension fund can take further action
advising the pension fund on data protection incidents

At PwC, we offer pension funds that outsource the role of Data Protection Advisor on a mandate basis. Registration with the data protection authority is based on a monthly lump sum. Additional services are provided on a quotation basis.

Further information about the Data Protection Advisor can also be found in this blog post.