GAWEL LEGAL

Data-protection advisor

GAWEL Legal acts as the independent data-protection advisor a Swiss controller may appoint under Art. 10 DSG, on a retainer. A controller that appoints an advisor may consult it instead of the EDÖB before high-risk processing flagged in an impact assessment; the retainer covers impact assessments, transfer reviews, the record of processing and breach readiness.

Discuss an advisor appointment View scope
Ongoing privacy work
Assessments
Impact assessments and transfer reviews
Records
Processing activities
Preparedness
Breach-notification procedures

The independent advisor function under Art. 10 DSG

Who this is for

  • Swiss controllers that want an independent Art. 10 DSG data-protection advisor
  • Companies needing ongoing DPIA, transfer, record-keeping and breach support
  • Life-sciences and ICT controllers running data-intensive or high-risk processing

Scope

  • Data-protection advisor under Art. 10 DSG:
    GAWEL Legal acts as the appointed, independent advisor: a contact point for data subjects and the authority, training and advising the controller and supporting the application of the data-protection rules (Art. 10(2) DSG)
  • EDÖB-consultation exemption:
    structuring the appointment so the controller can rely on the option to consult the advisor instead of the EDÖB where an impact assessment shows a high residual risk (Art. 23(1) and (4) DSG), including the independence, expertise and contact-publication conditions the exemption requires
  • Data-protection impact assessments:
    preparing and reviewing impact assessments for processing likely to entail a high risk to the personality or fundamental rights of data subjects (Art. 22–23 DSG)
  • Cross-border-transfer assessments:
    assessing disclosures abroad against adequacy decisions and the contractual and other safeguards that permit a transfer where no adequacy decision applies (Art. 16 DSG)
  • Record of processing:
    building and maintaining the Verzeichnis der Bearbeitungstätigkeiten, the record of processing activities required of controllers and processors (Art. 12 DSG)
  • Breach-notification readiness:
    playbooks and decision criteria so a data-security breach likely to entail a high risk can be reported to the EDÖB as quickly as possible, with data subjects informed where required (Art. 24 DSG)

How the work proceeds

  1. Scoping The first step covers the controller's processing, its risk profile, and whether an Art. 10 DSG advisor appointment is appropriate.
  2. Appointment The work covers the independent advisor appointment and the EDÖB-consultation exemption, with contact details published and notified.
  3. Baseline The record of processing is prepared, and existing impact assessments and transfer mechanisms are reviewed against the DSG.
  4. Operations The retainer covers recurring impact assessments, transfer reviews and breach readiness.
  5. Review The record, assessments and readiness materials are updated as processing and the legal position change.

Fees

Monthly retainer

Ongoing data-protection advice, with an additional tier for data-intensive controllers

Questions

Is a data-protection advisor mandatory under the DSG?
No. Appointing a data-protection advisor (called a data protection officer in the official English translation of the DSG) is voluntary for private controllers under Art. 10 DSG: the provision says they “may” appoint one. The benefit is operational: where a data-protection impact assessment shows that planned processing still carries a high residual risk, a controller that has consulted its appointed advisor may forgo consulting the EDÖB (Art. 23(1) and (4) DSG). To rely on that exemption, the controller must ensure that the advisor acts independently and without instructions, carries out no incompatible tasks and has the necessary expertise, and must publish the advisor's contact details and notify them to the EDÖB (Art. 10(3) DSG).
How is the Art. 10 DSG advisor different from the Art. 14 DSG representative?
They are distinct roles. The Art. 10 DSG data-protection advisor trains and advises the controller, supports the application of the data-protection rules, serves as the contact point for data subjects and the authorities (Art. 10(2) DSG), and allows the controller to use the EDÖB-consultation exemption in Art. 23(4) DSG. The Art. 14 DSG representative is a Swiss-based contact point that certain controllers without a Swiss establishment must designate so that data subjects and the authority can reach them in Switzerland. They are offered as separate services here, and a single client may need both.
When must a data-protection impact assessment be carried out?
Under Art. 22 DSG the controller must carry out a data-protection impact assessment in advance where the planned processing is likely to entail a high risk to the personality or fundamental rights of the data subject, in particular when new technologies are used, when sensitive personal data are processed on a large scale, or when public areas are systematically monitored on a large scale. If the assessment shows that a high residual risk remains despite the planned measures, the controller consults the EDÖB under Art. 23(1) DSG, unless it has instead consulted its Art. 10 DSG advisor (Art. 23(4) DSG).
What does the ongoing privacy-operations retainer cover?
The retainer covers recurring obligations: maintaining the record of processing under Art. 12 DSG, assessing cross-border disclosures under Art. 16 DSG against adequacy decisions and contractual safeguards, preparing and reviewing impact assessments under Art. 22–23 DSG, and keeping breach-notification readiness current so a security breach can be reported to the EDÖB as quickly as possible under Art. 24 DSG. Individual modules, for example a single impact assessment or a transfer-mechanism review, can be scoped separately and priced individually.

Related articles

Last updated: 4 October 2026

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss a data-protection mandate