Ordinance on the Act on Public Information, Data Protection and Archival Matters (VIDAG) - Application; Form, Content (VIDAG)

1. The request for access to official documents can be submitted informally and does not need to be justified.

2. The applicant must provide information that is reasonable and necessary to allow the public authority to identify the requested official document.

3. The public authority may require the applicant to specify the request.

4. The public authority shall inform the applicant that the request will not be processed if they fail to provide the necessary specification for identifying the requested document within a period of 20 days (§ 36 para. 1 IDAG).

5. If the requested specification is not provided, the public authority shall notify the applicant in writing that the request will not be processed.

1. Requests for access to official documents shall be handled by the public authority that processes the records or has them processed by third parties.

2. Requests for access to official documents of the Grand Council shall be handled by the office. If access to a commission's records is requested, the commission itself shall handle the requests. If the commission no longer exists, the requests shall be handled by the office.

3. ...

4. Requests submitted to an incompetent authority shall be forwarded to the competent public authority.

**1. Access to Official Documents**

If access to the official documents is granted through an on-site inspection, the public authority must ensure adequate protection of the documents.

**1. Public Bodies are required to implement the following measures in the electronic processing of personal data to ensure confidentiality, integrity, availability, accountability, traceability, and deletion deadlines:**

a) **Access Control:** Unauthorized individuals must be denied access to facilities where personal data is processed.

b) **Data Carrier Control:** Unauthorized individuals must be prevented from reading, copying, altering, or removing data carriers.

c) **Transport Control:** It must be ensured that personal data cannot be read, copied, altered, or deleted without authorization during their disclosure or during the transport of data carriers.

d) **Disclosure Control:** Recipients of data disclosed via data transmission facilities must be identifiable.

e) **Storage Control:** Unauthorized entry into storage and unauthorized inspection, alteration, or deletion of stored personal data must be prevented.

f) **User Control:** The use of automated data processing systems via data transmission facilities by unauthorized individuals must be prevented.

g) **Access Control:** Access by authorized individuals must be limited to those personal data necessary for the completion of their duties.

h) **Input Control:** It must be possible to subsequently check in electronic systems which personal data was entered when and by whom.

i) **Recovery:** Ensuring that systems used can be restored in the event of a disruption.

j) **Reliability, Integrity:** Ensuring that all functions of the system are available, malfunctions are reported, and stored personal data are not damaged by system malfunctions.

**2. The measures are guided by the purpose, nature, and extent of the data processing, as well as potential risks to the personal rights of affected individuals. They must be periodically reviewed for purposefulness and proportionality and adjusted to technical developments.**

**3. Public bodies establish their data security concept and determine the retention periods for the data they process, considering provider obligations under archival legislation.**

**4. Personal data not transferred to the archive must be deleted no later than one year after the expiration of a time-limited provider obligation under archival legislation or ten years after its creation, unless it is demonstrably still needed for fulfilling duties or for evidentiary purposes. The review must be repeated at least every ten years. Special provisions in other statutes remain reserved.**

1. Public authorities must document, when operating an electronic system for processing personal data, the measures taken to ensure data security, as well as their review and updating.

2. Accesses to personal data must be logged as follows, if compliance with protection objectives cannot be ensured in another way

a) * Accesses by system administrators

b) * Accesses by users for

1. Authentication and authorization,

2. Data entry and modification,

3. Data viewing,

4. Data transmission,

5. Data deletion.

2bis The logs must be kept in an auditable manner for one year. They may only be used to verify the legality of data processing and to ensure information and information technology security.

3. ...

1. Public authorities shall conduct a data protection impact assessment whenever introducing or expanding an information technology application with personal data, or when changes in technology are expected to lead to an increased risk to the personality and fundamental rights of the affected person. An increased risk is specifically assumed if

a) * the system enables profiling,

b) * particularly sensitive personal data is processed,

c) * processing of personal data is carried out by contractors,

d) * two or more public authorities process personal data in a joint electronic system.

2. The data protection impact assessment may be waived, insofar as and to the extent that the data processing is explicitly regulated in the statutory basis.

3. Public authorities shall record the results of the data protection impact assessment in writing (§ 17a Abs. 2 IDAG). A copy is to be provided to the appointed person for public access and data protection if the application is not submitted for prior consultation.

1. The Data Protection Impact Assessment shall include at least

a) the responsible public body, the legal basis, the purpose and a systematic description of the planned data processing activities,

b) an assessment of the necessity and proportionality of the data processing activities in relation to the purpose,

c) an assessment of the risks to the personality rights and fundamental rights of the data subjects, taking into account the protection objectives according to § 4 paragraph 1, and

d) the technical and organizational measures planned to address the risks (§ 4 paragraph 1), including with respect to data processing activities conducted by commissioned third parties.

1. With the request for a preliminary consultation (§ 17b IDAG), the responsible public authority submits the documentation of the data protection impact assessment.

2. The public authority does not execute the planned data processing until the consultation is concluded.

3. The consultation is concluded when the person commissioned for public and data protection declares the application to be harmless or has issued a recommendation according to § 17b para. 2 IDAG.

1. Data Security Breaches are, in particular, security breaches that lead to the destruction, loss, alteration, or unauthorized access to personal data.

2. The protection of the affected individual does not require notification if

a) the technical and organizational measures of the public authority have prevented unauthorized individuals from gaining knowledge of the personal data, or

b) the public authority has ensured through subsequent measures that, in all likelihood, there no longer exists an increased risk to the personality and fundamental rights of the affected individuals, or

c) this would involve a disproportionate effort, and instead, a public announcement or another effective information measure is carried out.

**1. Particularly Sensitive Personal Data Includes:**

a) Data concerning religious, ideological, political, or union-related activities,

b) Health, privacy, or ethnic origin,

c) Measures of social assistance,

d) Administrative or criminal proceedings and sanctions.

e)* Inherited or acquired genetic characteristics of a person that provide unique information about their physiology or health and that are obtained especially from the analysis of a biological sample from the person concerned (genetic data),

f)* Physical, physiological, or behavioral characteristics of a person obtained through special technical processes that allow or confirm the unique identification of this person (biometric data).

1. In the case of data disclosures for non-personal purposes, particularly for research, planning, and statistics, informing the affected individuals may be omitted. Divergent legal provisions remain reserved.

2. If data is collected and stored solely for the purpose of ensuring and monitoring data security, there is no obligation to inform the affected individuals.

3. If data is collected and stored solely for compliance with retention and archiving regulations, there is no obligation to inform the affected individuals.

1. The data block pursuant to § 16 IDAG is to be confirmed in writing to the affected individuals by the residents' registration office.

2. The request for lifting a data block must be submitted in writing.

1. A legitimate interest pursuant to § 16 paragraph 1 of the IDAG particularly exists when there is a legal, economic, or personal relationship with the person about whom information is being requested.

2. The non-material purpose pursuant to § 16 paragraph 2 of the IDAG is particularly present

a) in political parties to promote political interests,

b) in non-profit organizations for the recruitment of members and for fundraising appeals; the ZEWO quality seal or the corresponding recognition by the tax office of the Canton of Aargau serves as proof of non-profit status,

c) in local and regional associations and organizations to promote community life, health care, sports, or culture.

1. The residents' registration office may require the submission of a declaration in which the applicant undertakes to comply with conditions for the disclosure of personal data pursuant to § 16 IDAG, particularly with regard to processing exclusively for the specified purpose or adhering to the prohibition on dissemination.

2. The declaration of commitment may be coupled with the agreement of a penalty clause in the event of non-compliance with the conditions.

1. If publicly accessible spaces are monitored with optical-electronic devices according to § 20 IDAG in such a way that personal identification is possible, the following information must be recorded in a regulation at a minimum

a) Purpose of the surveillance,

b) Designation of the person or entity tasked with conducting the surveillance and authorized to process the data, particularly to evaluate it,

c) Identification of the buildings and locations being monitored,

d) Determination of surveillance times,

e) Specification of whether the data will be stored and, if so, for how long.

2. The optical-electronic devices must be configured to collect only the absolutely necessary data.

3. The collected data may only be used for the intended purpose. The public authority must ensure data security in accordance with § 4.

4. The regulation must be submitted to the person responsible for public information and data protection along with the application for approval (§ 20 para. 1 sentence 2 IDAG).

1. Contractors for the processing of personal data must be selected by the public authority with particular consideration of the technical and organizational measures taken by them. The following must be defined by contract or stipulations

a) The subject matter and duration of the contract,

b) The scope, nature, and purpose of the intended data processing, the type of data, and the circle of affected persons,

c) The technical and organizational measures to be taken to ensure data security, their monitoring and documentation,

d) Enforcement of claims by affected persons,

e) Obligation of confidentiality and extension of this duty to all data processors,

f) Any authorization for the awarding of subcontracts,

g) Control rights of the commissioning public authority and corresponding tolerance and cooperation obligations of the contractor,

h) Duty of the contractor to report data security breaches,

i) Instruction authority of the public authority,

j) The return of provided data carriers and the deletion of data stored by the contractor.

2. If the processing of personal data does not constitute the main obligation of the contractor, the agreement or stipulations must be oriented in accordance with the content of Section 1.

1. Close relatives who have a right of access under § 26 IDAG are persons who were related to or related by marriage to the deceased in a direct line or up to the degree of nieces and nephews.

1. Personal data, which cannot be proven accurate by the responsible public authority, should only not be deleted and instead be marked with an appropriate note, if otherwise, no official data corresponding to the purpose of data collection would remain available for this person.

1. The person appointed for Public Access and Data Protection is administratively affiliated with the Department of Economic Affairs and the Interior.

2. The person appointed for Public Access and Data Protection recruits their own staff. They may consult experts if the fulfillment of their duties requires specific expertise.

1. Requests for information and/or access to official documents should be processed within 10 days if possible.

2. ...

3. Public authorities shall issue a written statement within 30 days after receiving a recommendation pursuant to § 32 paragraph 3 IDAG, indicating whether they accept the recommendation.

1. The person responsible for public relations and data protection ensures an appropriate publication of the recommendations and decisions in accordance with § 32 paragraphs 3-5 IDAG in an anonymized form, preferably on the Internet.

1. If questions arise regarding IT security or other IT-related issues, the person appointed for Public Access and Data Protection obtains the opinion of the Department of Finance and Resources.

2. Before enacting laws, ordinances, guidelines, regulations, or instructions within the application area of IDAG, public authorities obtain the opinion of the person appointed for Public Access and Data Protection.

3. Decisions within the application area of IDAG are to be delivered to the person appointed for Public Access and Data Protection, unless they are already a party. They are authorized to file administrative and administrative court complaints.

4. If the person appointed for Public Access and Data Protection has had the opportunity to file a complaint, they neither issue recommendations nor orders in the same matter, unless there are reconsideration grounds pursuant to § 39 para. 2 of the Administrative Procedure Act (Verwaltungsrechtspflegegesetz, VRPG) dated December 4, 2007.

1. The amount of fees to be collected by public authorities pursuant to § 40 para. 2 of the IDAG is determined in accordance with § 5 of the Fee Ordinance (GebührV) dated March 13, 2024.

2. ...

**1. Public authorities are responsible for the collection, organization, and secure storage of documents and other records within their jurisdiction that serve the fulfillment of public duties, regardless of the format and medium of information (information).**

**2. They manage the documents and information under their control within files that can be clearly assigned to a position in the maintained organizational system.**

**2bis. Excluded from file formation are pieces of information that, due to their intended use, are not suitable for this purpose and are processed using appropriate information technology. These pieces of information must also be clearly assigned to a position in the maintained organizational system.**

**3. ...**

1. For the cantonal administration, with the exception of independent public-law institutions, the Ordinance on Record Management in the Cantonal Administration (RecordMO) of October 29, 2025, applies.

1. The following cantonal authorities (obligated entities) are required to offer all dossiers and information to the State Archives when their retention periods have expired and they no longer need them permanently

a) Grand Council,

b) Courts, including conciliation authorities, bankruptcy office, and debt enforcement inspectorate,

c) Executive Council,

d) State Chancellery and Departments, including dependent public law institutions,

e) Designated Officer for Public Information and Data Protection,

f) Financial Control,

g) Commissions and working groups assigned to any of the aforementioned authorities.

1. The independent public-law institutions of the canton maintain their own archives.

2. They may agree with the state archive to offer files and information that are of public and scientific importance. Sections 24-26b apply correspondingly.

1. The State Archives, in collaboration with the obligatory submitting entities, determines which dossiers and information are deemed worthy of archiving.

2. The submitting entities, in consultation with the State Archives, determine the minimal retention periods for their dossiers and information that are appropriate for legal and administrative reasons.

3. The calculation of the retention period begins from the date of the most recent document of a case. For information pursuant to § 23 paragraph 2bis, the State Archives, in collaboration with the obligatory submitting entity, sets regular intervals for delivery in accordance with § 26a.

1. Overriding Public Interests According to § 45 Para. 3 IDAG exist particularly when the inspection of the dossiers and information is likely to

a) endanger the security of the canton,

b) permanently impair the relationship with foreign states, international organizations, or between the Canton of Aargau and the federal government or other cantons, or

c) severely impair the ability of the executive council to act.

2. If the impediments according to § 45 Para. 3 IDAG no longer exist or if the extended deadline has expired, the dossiers and information are to be promptly offered to the state archive.

1. The obligated entities must transfer the dossiers and information deemed worthy of archiving to the State Archives.

2. The delivery shall comply with the requirements set by the State Archives.

1. The obligated entities are required to destroy files and information deemed non-archivable by the state archive.

2. They ensure the orderly destruction and document every instance of destruction.

3. The following actions with files and information require the approval of the state archive

a) Destruction,

b) Electronic replacement of extensive, paper-based files.

4. The state archive does not destroy any archival material without the written consent of the responsible obligated entity.

1. Under the supervision of the State Archive are all storage facilities and locations for dossiers and information of the mandatory offering entities and the independent public-law institutions of the canton.

2. Within the scope of its supervision, the State Archive may, in particular

a) Request information and documents,

b) Issue reminders and directives,

c) Order measures to restore lawful conditions if there are significant public interests in the archiving of these dossiers or information.

1. The archival material of the State Archive includes

a) Archival material of Aargau from the time of the legal predecessors of the canton until 1798, as well as the Helvetic cantons of Aargau, Baden, and Fricktal (including the archival material of the dissolved religious institutions),

b) Archival material of the public bodies of the canton since 1803,

c) Other archival material that is significant for the history of the canton, localities, and individuals, and is given to or entrusted to the State Archive as property or deposit—by institutions, organizations, natural and legal persons—or otherwise comes into the possession of the State Archive,

d) ...

e) A reference library.

1. Archived materials are open to public inspection.

2. Access to archived materials from estates and deposits is governed by the provisions of the acquisition contracts.

3. Details are regulated by the State Archives in a user regulation, which must be approved by the Government Council. The user regulation also outlines the basic principles for lending and commercial use in accordance with Sections 28 and 29.

1. The State Archive may conduct investigations for third parties.

2. ...

3. ...

1. The State Archive may lend archival materials for scientific research and exhibition purposes for an appropriate period, provided that proper handling and security are ensured.

1. The State Archive shall determine, on a case-by-case basis, the prerequisites and the procedure for the commercial use of archive materials.

2. The relevant contracts must be signed by the Head of the Department of Education, Culture, and Sport for their validity.

1. The supervisory authority over the State Archives is exercised by an archival commission consisting of five to seven members. It supports and advises the government council in the promotion and coordination of archival management in the canton.

2. The government council elects the members of the archival commission and its chairperson for a term of four years.

1. The necessary technical and organizational adjustments pursuant to § 5 must be made no later than four years after the entry into force of this regulation.

1. This regulation shall be published in the official collection of laws. It shall enter into force on July 1, 2008.