Skip to main content

Data and digital operations · France and Switzerland : separate country-labelled rules

Data protection impact assessment: prepare the file

A data protection impact assessment concerns a defined processing project, its effects on people and the measures proposed. France's GDPR assessment and Switzerland's LPD assessment have their own conditions. Map purposes, data, affected people, risks and alternatives before checking obligations or authority consultation. A vendor questionnaire or a generic privacy-policy template is not the assessment itself.

Go to the toolSee the texts cited
  • Official texts cited
  • Sources checked on
  • Drafted with AI assistance, our method

By the AlphaDeep legal editorial team

General legal information with official references and dated checks. It is not personalised advice: for a decision that commits you, have your situation checked by a qualified professional.

Julie by AlphaDeep

Illustrative conversation
Example question

When is a prior impact assessment required?

Julie Illustration

France's GDPR35 and Switzerland's LPD22 use their own high-risk conditions and exceptions. Assess the actual processing rather than importing one jurisdiction's checklist.

Read the references

Your question concerns “Data protection impact assessment: prepare the file”. I can help organise the facts and records. Which document have you received or prepared, and is this a French or Swiss matter?

French law

3 free questions at signup. Avoid names and sensitive information.

Answer

What processing should the assessment describe?

Define purpose, data, people, actors and flows before deployment. A company-wide description does not identify the actual operations.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

The law

Which official provision helps explain this situation?

Le responsable du traitement effectue préalablement à la mise en œuvre du traitement une analyse d'impact des opérations de traitement envisagées sur la protection des données à caractère personnel dans les conditions prévues à l'article 35 du règlement (UE) 2016/679 du 27 avril 2016.

Loi Informatique et Libertés art. 62In force since 1 June 2019Read on Légifrance

In plain English: No. GDPR36 and Swiss LPD23 have distinct prior-consultation conditions. Swiss law also includes a specified private-controller adviser exception.

Preparation schematic: connect records and questions. It does not guarantee a legal outcome. Data protection impact assessment: prepare the file
Preparation schematic: connect records and questions. It does not guarantee a legal outcome.
Answer

When is a prior impact assessment required?

France's GDPR35 and Switzerland's LPD22 use their own high-risk conditions and exceptions. Assess the actual processing rather than importing one jurisdiction's checklist.

Tool

Which records are still missing from your file?

Indicate which records you have. The result identifies gaps and prepares a complete question for Julie, without requiring an account.

julie://tool/aiguillageNothing leaves your browser

Answers stay on this page until you explicitly continue to Julie. Avoid names and sensitive information.

Fictional example · Your preparation

Point to complete: Residual risk. Record residual risk, assumptions and unresolved points. A completed field or green indicator does not prove measures work.

Proposed processing
Record available
Risks to individuals
Record available
Mitigation measures
Record available
Residual risk
Needs checking
Records indicated
3 / 4
  1. What remains after mitigation?

This worksheet organises records; it does not establish admissibility, entitlement or a procedural outcome.

Answer

How should measures connect to risks?

For each possible harm to people, record the measure, owner and evidence of implementation. A disconnected security catalogue does not explain mitigation.

Answer

What remains after mitigation?

Record residual risk, assumptions and unresolved points. A completed field or green indicator does not prove measures work.

Answer

Must every assessment go to a regulator?

No. GDPR36 and Swiss LPD23 have distinct prior-consultation conditions. Swiss law also includes a specified private-controller adviser exception.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Comparison

Which documents answer which questions?

Which documents answer which questions?
Record or informationIssue to check
Proposed processingDefine purpose, data, people, actors and flows before deployment. A company-wide description does not identify the actual operations.
Risks to individualsFrance's GDPR35 and Switzerland's LPD22 use their own high-risk conditions and exceptions. Assess the actual processing rather than importing one jurisdiction's checklist.
Mitigation measuresFor each possible harm to people, record the measure, owner and evidence of implementation. A disconnected security catalogue does not explain mitigation.
Residual riskRecord residual risk, assumptions and unresolved points. A completed field or green indicator does not prove measures work.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Answer

When should the assessment be revisited?

France's GDPR35 includes review where necessary, at least when processing risk changes. Record changes rather than treating the initial document as permanent approval.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Answer

Who owns the assessment decisions?

Distinguish the controller, any designated adviser and technical contributors. Using a worksheet transfers none of their legal responsibilities.

Answer

What can this free worksheet conclude?

It identifies gaps between processing, risks, measures and residual risk. It does not certify compliance or produce an authoritative risk score.

Frequent questions

What other questions arise in this file?

When is a prior impact assessment required?

France's GDPR35 and Switzerland's LPD22 use their own high-risk conditions and exceptions. Assess the actual processing rather than importing one jurisdiction's checklist.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

What remains after mitigation?

Record residual risk, assumptions and unresolved points. A completed field or green indicator does not prove measures work.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Must every assessment go to a regulator?

No. GDPR36 and Swiss LPD23 have distinct prior-consultation conditions. Swiss law also includes a specified private-controller adviser exception.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Who owns the assessment decisions?

Distinguish the controller, any designated adviser and technical contributors. Using a worksheet transfers none of their legal responsibilities.

Loi Informatique et Libertés art. 62Loi Informatique et Libertés art. 63RGPD, article 35: Analyse d’impactRGPD, article 36: Consultation préalable235.1 : Art. 22 Analyse d’impact relative à la protection des données personnelles235.1 : Art. 23 Consultation préalable du PFPDTCNIL : RGPD, sommaire et considérants

Sources

Which official references should you consult?

  1. Loi Informatique et Libertés art. 62Légifrance
  2. Loi Informatique et Libertés art. 63Légifrance
  3. RGPD, article 35: Analyse d’impactSource officielle
  4. RGPD, article 36: Consultation préalableSource officielle
  5. 235.1 : Art. 22 Analyse d’impact relative à la protection des données personnellesFedlex
  6. 235.1 : Art. 23 Consultation préalable du PFPDTFedlex
  7. CNIL : RGPD, sommaire et considérantsSource officielle

Texts cited last checked: 1 November 2026

Next steps

Which neighbouring situations should remain separate?