Ordinance on the Cantonal Data Protection Act (Cantonal Data Protection Ordinance, VKDSG) - Proof of Compliance with Data Protection Regulations (VKDSG)

**1. The public authority demonstrates compliance with data protection regulations by documenting at least the following points related to processing activities:**

a) the processes of data processing;

b) the responsible individuals;

c) the legal basis for data processing;

d) the data protection risks and the measures taken.

**2. The public authority may particularly demonstrate compliance through:**

a) internal regulations and other general provisions on business processes and organizational operations;

b) instructions on data processing and handling of personal data, including deletion and archiving;

c) information security and data protection concepts, as well as data protection impact assessments;

d) concepts for accessing information and IT resources;

e) reports on handling reportable data security breaches;

f) other documents and tools for secure data processing.

1. Public authorities shall ensure, through appropriate organizational and technical measures, that personal data

a) is accessible only to authorized individuals (Confidentiality);

b) is available when needed (Availability);

c) is not altered without authorization or unintentionally (Integrity);

d) is processed in a traceable manner (Traceability).

1. The adequacy of the technical and organizational measures is determined particularly by the following criteria

a) the need for protection of the processed data, which arises from the purpose, nature, scope, and circumstances of the data processing;

b) the assessment of the potential risks to the affected individuals;

c) the state of the art.

2. The measures are to be periodically reviewed for their effectiveness and proportionality, and adjusted as necessary.

1. To ensure data security, the following technical and organizational measures may, in particular, be taken

a) Access Restrictions to Facilities: Unauthorized persons must be denied access to facilities where material and personal data are processed;

b) User Controls: Unauthorized persons must be prohibited from using IT resources that process material and personal data;

c) Data Carrier Controls: Unauthorized persons must be prevented from reading, copying, altering, or removing data carriers;

d) Access Restrictions: Access must be limited to the material and personal data necessary for authorized persons to fulfill their duties;

e) Processing Restrictions: Unauthorized processing of material and personal data is prevented;

f) Input Controls: It must be possible to retrospectively verify which material and personal data were processed at what time and by which person when using IT resources;

g) Recipient Identification: Recipients to whom material and personal data are disclosed must be identifiable;

h) Continuity Assurance: Provisions are made to ensure that in the event of a failure of IT resources, important functions can be resumed as quickly as possible;

i) Generational Continuity Assurance: Provisions are made to ensure that material and personal data can be preserved over time despite technological changes in the use of IT resources.

1. Public bodies shall log, during the automated processing of personal data, at least the storage, modification, reading, disclosure, deletion, and destruction of the data, if preventive measures do not ensure data protection and such a system is available on the market.

2. The logging must provide information about the identity of the person who carried out the processing, the nature, date and time of the processing, and, if applicable, the identity of the recipient of the data.

1. The implementation of a pilot phase is indispensable for the practical execution of data processing when one of the following conditions is met

a) The fulfillment of a task requires technological innovations, whose impacts must first be evaluated;

b) The fulfillment of a task necessitates significant organizational or technical measures, whose effectiveness must first be tested, particularly in collaboration with bodies of other public entities and organizations created by public entities;

c) The fulfillment of a task requires that personal data be accessible through a retrieval process.

1. The public authority conducting the pilot project shall obtain the opinion of the supervisory body.

2. It shall provide the supervisory body with all documents necessary to assess the pilot project's eligibility for approval, in particular

a) a general description of the pilot project;

b) a report demonstrating that fulfilling the legally mandated tasks necessitates data processing and that a trial phase prior to the law's enactment is indispensable;

c) a description of the security and data protection measures;

d) the draft of a regulation governing the details of the processing, or the concept of a regulation.

3. The opinion must be submitted to the government before it makes a decision on the approval application.

1. To the extent that processing by a contractor is not legally specified, at least the following points shall be contractually regulated

a) Subject matter and scope of the assigned tasks;

b) Preservation of official secrecy as well as special confidentiality obligations;

c) Responsibilities;

d) Technical and organizational measures to ensure data protection and data security;

e) Location of data processing;

f) Supervision of contract fulfillment;

g) Involvement of third parties;

h) Sanctions provided for in case of breach of duty;

i) Contract duration and conditions for contract termination as well as its consequences, in particular the repatriation and deletion of data;

j) Applicable law and jurisdiction.

1. The prior approval of the public authority, which allows the processor to engage third parties for data processing, may be specific or general in nature.

2. In the case of a general approval, the processor must inform the responsible public authority of any intended changes regarding the engagement or replacement of other third parties. The responsible public authority may reject this change.

1. The public authority may rely on the Federal assessment of the adequacy of the data protection in a state, a territory, a specific sector within a state, or an international body in accordance with Article 8 of the Data Protection Regulation to evaluate whether the legislation of a recipient state ensures adequate protection.

2. If the supervisory authority has been informed about the guarantees in accordance with Article 12 paragraph 3 of the Cantonal Data Protection Act, the obligation to provide information is considered fulfilled for all subsequent disclosures made under the same guarantees, provided that the categories of recipients, the purpose of processing, and the data categories remain essentially unchanged.

3. The obligation to provide information is also considered fulfilled when data is transferred based on model contracts or standard contractual clauses created or recognized by the Federal Data Protection and Information Commissioner, and when the supervisory authority has been informed generally by the responsible public authority about the use of these model contracts or standard contractual clauses.

1. If personal data is made publicly accessible through automated information and communication services, this is not considered a transfer abroad.

1. If personal data is to be disclosed for a non-personal purpose, the recipient must provide at least the following information

a) Identification of the recipient;

b) Brief description of the project;

c) Specification of the required personal data;

d) Process and method of data handling;

e) Information on measures to be implemented for the protection of personal data.

2. The public authority shall obtain a declaration of commitment from the recipient that the requirements of Article 13, Paragraph 1, Letter a of the Cantonal Data Protection Act are met. It may impose further conditions on the disclosure of personal data to ensure their protection.

1. At least the documents produced in the context of the data protection impact assessment must be submitted to the supervisory authority. The supervisory authority may request additional documents if they are necessary to assess the risk to fundamental rights.

2. The prior consultation may be waived if the involvement of the supervisory authority in the project's organization is ensured by other means.

3. The prior consultation is concluded when the supervisory authority declares the application to be unobjectionable or issues a recommendation in accordance with Article 36 of the Cantonal Data Protection Act.

1. The public authority shall retain the data protection impact assessment and the results of the prior consultation for at least two years beyond the termination of the processing activity.

1. The supervisory authority provides a form for reporting data security breaches.

2. If the public body is unable to report all information simultaneously, it shall provide the missing information as soon as possible.

3. The public body must document the data security breach. The documentation must include the facts related to the incidents, their effects, and the measures taken. It must be retained for at least two years beyond the notification.

1. If the public body is obliged to inform the affected individual about a data security breach, the individual shall be informed in plain and comprehensible language of at least the following

a) the nature of the breach;

b) the consequences, including any potential risks, for the affected individuals;

c) what measures have been taken or are planned to remedy the breach and to mitigate the consequences, including any potential risks;

d) the name and contact details of a contact person.

2. If an individual notification about the data security breach appears disproportionate due to the large number of affected individuals, the information may be published in an appropriate manner.

1. The obligations of this section apply to the public authorities designated in Article 22 and Article 23 of the Cantonal Data Protection Act, as well as to

a) the Office of Correctional Services;

b) the Cantonal Police;

c) the Public Prosecutor's Office;

d) the Municipal Police of Chur.

2. Other public authorities may voluntarily implement the specific provisions in accordance with Article 22 and Article 23 of the Cantonal Data Protection Act. If they choose to do so, they must comply with the provisions of this section.

1. The affected public authorities shall regularly update the register of processing activities.

2. Changes must be reported to the supervisory authority.

3. Public authorities that voluntarily maintain the register of processing activities are exempt from the reporting obligation.

1. The affected public authorities shall designate at least one person as a data protection officer who possesses the requisite expertise.

2. Multiple affected public authorities may jointly appoint a data protection officer.

3. The name and contact details of the data protection officer must be communicated to the supervisory authority and published.

4. The supervisory authority periodically trains the data protection officers.

1. The affected person may assert their rights with the responsible public authority either in writing or orally.

2. The responsible public authority must take appropriate measures to identify the affected person, who is obliged to cooperate.

**1. The responsible public authority shall make personal data accessible as far as possible in the form created for official use. Information may be provided electronically if the transmission is sufficiently protected against access by unauthorized third parties.**

**2. In agreement with the responsible public authority, the concerned individual may inspect their data on-site. Information may be provided orally if the concerned individual consents.**

1. The responsible public authority that has received the objection confirms the filing of the objection in an appropriate form. It ensures that other public authorities, which have received the affected personal data from it, are informed about the objection.

2. If the affected person requests the withdrawal of the objection, they shall notify the responsible public authority in writing.

1. Disproportionate Effort is Particularly Present When

a) The affected individual submits a request repeatedly on the same matter;

b) The affected individual fails to comply with the cooperation duty despite being requested to do so by the responsible authority; or

c) The processing of the request involves significant factual or time expenditure.

2. The responsible public authority must inform the affected individual of the cost amount prior to providing the information. If the affected individual does not confirm the request within ten days, it is considered withdrawn.

1. Existing IT systems that do not provide for logging pursuant to Article 5 may continue to be operated until the end of their lifecycle. Article 5 must be observed when they are replaced by a new system.

2. Existing agreements on data processing remain valid until their expiration. Articles 8 and 9 must be observed if they are renewed or amended.