{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["DPIA Main","DPIA Measure Catalog","DPIA Risk Catalog","FAQ","Config","Changelog"],"not_rendered":{"charts":0,"images":4,"macros":1,"external_links":0,"defined_names":7,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"DPIA Main","index":0,"n_rows":222,"n_cols":20,"rows_kept":222,"cut":false,"hidden":false,"merged":[[214,12,217,12],[215,0,215,5],[125,5,126,5],[207,2,207,5],[204,2,204,5],[210,2,210,5],[214,0,214,6],[177,1,178,1],[179,1,180,1],[181,1,182,1],[177,3,177,6],[178,3,178,6],[179,3,179,6],[217,0,217,6],[181,3,181,6],[182,3,182,6],[218,0,218,6],[0,0,0,1],[6,2,6,3],[5,2,5,3],[205,2,205,5],[206,2,206,5],[23,2,23,5],[24,2,24,5],[25,2,25,5],[29,2,29,5],[30,2,30,5],[7,2,7,3],[8,2,8,3],[21,2,21,5],[1,0,1,1],[17,2,17,5],[18,2,18,5],[20,2,20,5],[180,3,180,6],[3,8,3,10],[12,2,12,3],[3,0,3,5],[10,2,10,3],[16,2,16,5],[19,2,19,5],[22,2,22,5],[171,1,172,1],[121,12,125,12],[125,4,126,4],[37,12,40,12],[35,12,36,12],[39,3,41,4],[189,2,189,3],[190,2,190,3],[191,2,191,3],[192,2,192,3],[193,2,193,3],[194,2,194,3],[195,2,195,3],[196,2,196,3],[197,2,197,3],[198,2,198,3]]}
["Data Protection Impact Assessment (DPIA)",null,{"$f":"_xlfn.CONCAT($B$128:$B$168)","v":"Personal data used in the project is leaked due to an error or intentionally to unauthorized third parties. They misuse it to the detriment of the affected individuals.Personal data used in the project is leaked due to an error or intentionally to an unauthorized internal person. This person misuses it to the detriment of the affected individuals.Personal data used in the project is accidentally deleted in whole or in part. This leads to a disadvantage for the affected individuals.Personal data used in the project is partially or completely deleted by an attacker. This leads to a disadvantage for the affected individuals.The solution or the systems with which we process the personal data used in the project no longer allows us to access or otherwise process the data. This leads to a disadvantage for the affected individuals.Personal data used in the project is manipulated by an external attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.Personal data used in the project is manipulated by an internal attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.Personal data used in the project is not updated due to an error in the solution, system, or operation, partially deleted or otherwise falsified, which we do not notice immediately and which in turn leads to a disadvantage for the affected persons.The affected individuals do not realize that we are collecting their personal data or what we are doing with it. This lack of transparency leads to distrust and discomfort among these individuals and other disadvantages for them.Personal data used in the project is misused by us compared to our original communication, which leads to distrust and discomfort by the affected persons and other disadvantages for them.Personal data used in the project is used contrary to applicable rules by a third party for purposes other than intended, which leads to distrust and discomfort by the affected persons and other disadvantages for them.We are unable to satisfy an affected individual's access right, i.e. the information about their relevant personal data and the other aspects of data processing that they may ask us about or request. As a result, they cannot properly enforce their legal rights to ensure their data protection.We are unable to delete the data of an affected individual at its request, even though we should do so. This leads to discomfort among the affected individuals and other disadvantages for them.We are unable to correct the data of an affected individual at ist request, even though we should do this. This leads to discomfort of the affected individuals and other disadvantages for them, because we process incorrect or incomplete data about them.We are unable to delete the personal data no longer needed. This leads to such data being misused to the detriment of the affected individuals or they can fall into the hands of unauthorized persons, with all the consequences of such an incident.Our data processing has errors or gaps. This leads to affected individuals suffering financial losses or disadvantages.Our data processing has errors or gaps. This leads to services being denied to affected individuals in an unintended manner."},{"$f":"ROW($B$128)+((MAX($A$127:$A$168)-4)*100)","v":144.99999999999963},{"$f":"ROW($B$46)","v":46},{"$f":"\"What is planned: \"&$C$18&\"\\n Business process or business area: \"&$C$17&\"\\n What objectives and interests are being pursued: \"&$C$19&\"\\n Data subjects: \"&$C$23&\"\\n Categories of data: \"&$C$22&\"\\n Means and techniques used: \"&$C$20&\"\\n Entities and providers involved: \"&$C$21&\"\\n Data processing locations: \"&$C$24&\"\\n Special aspects: \"&$C$26","v":"What is planned: This is about voice recognition: All conversations are recorded and processed by AI. The voice print is then stored in a database. With each call, a new voice print is created and this is compared with the stored voice print. The call center agent is shown if it matches.\\n Business process or business area: Handling calls in the call center\\n What objectives and interests are being pursued: The voice print is intended to help the call center agent verify the identity of a caller to the call center and thus increase security.\\n Data subjects: Caller\\n Categories of data: Voiceprint, a person's ID, voice recordings\\n Means and techniques used: A standard solution from the US manufacturer StarVoice Inc. is used, which we operate in the cloud here in Switzerland.\\n Entities and providers involved: The solution runs on Microsoft Azure by Microsoft Ireland Operations Ltd. Other third parties are not involved.\\n Data processing locations: Switzerland\\n Special aspects: "},{"$f":"$C$18&\"(\"&$C$17&\")\"","v":"This is about voice recognition: All conversations are recorded and processed by AI. The voice print is then stored in a database. With each call, a new voice print is created and this is compared with the stored voice print. The call center agent is shown if it matches.(Handling calls in the call center)"},{"$f":"ROW($B$89)","v":89}]
["Version 22.9.2024 - Private Sector CH-FADP/GDPR",null,{"$f":"_xlfn.CONCAT($G$46:$G$83)&_xlfn.CONCAT($G$89:$G$117)","v":"Training: We train the correct use of the solution to reduce the risk of errors in the processing of personal data./nUser Manual: We provide the employees with a user manual that shows them how to correctly use the solution and how it works. This reduces the risk of errors, which could be detrimental to the affected individuals./nAuthorization Concept: We have established an authorization concept based on the \"need-to-know\" principle. In this way, we can limit data security risks and at the same time ensure the proportionality of processing concerning access rights./nProcess for right of access: We have defined who is responsible for dealing with access requests. This person knows what to do./nProcess for deletion requests: We have defined who is responsible for dealing with deletion requests. This person knows what to do./nPrivacy notice: We have outlined the relevant collection and other processing of personal data in a law-compliant privacy statement./nReferences to data collection: When we collect personal data, we not only point this out to the affected individuals in the privacy notice, but also on forms, signs or other suitable ways that they can immediately recognize./nCompliance check: We have successfully had the relevant processing of personal data checked for its compliance with data protection./nISMS: We have an Information Security Management System (ISMS). This ensures that information security, especially in relation to the project and the personal data processed with it, is regularly reviewed and improved as needed./nRecords of processing activities: We enter the data in our Records of Processing Activities (ROPA) and ensure that it is updated upon changes./nRight to delete ensured: We have ensured that the personal data processed for the project can also be deleted or anonymized as far as legally required./n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /nOnline access control: Only authorized individuals can access the non-public personal data of the project. This is to prevent any abusive or otherwise uncontrolled use./nPhysical access control: Only authorized persons have physical access to the premises and facilities where personal data is processed. This prevents abusive or otherwise uncontrolled use./nUser authentication: We authenticate all users who want to access our systems. This helps us prevent abusive or otherwise uncontrolled use. This also serves for logging./nMFA for external access: All users who want to externally access the systems with which the relevant personal data is processed have to authenticate themselves using multi-factor authentication./nMFA for privileged accesses: All users who have elevated privileges with regard to the systems that process the personal data relevant must authenticate themselves using multi-factor authentication./nEncryption \"mobile\": We encrypt mobile data carriers (including mobile computers) that contain personal data, so that an unauthorized person cannot do anything with it./nEncryption \"at rest\": We encrypt personal data when it is stored on the systems (i.e., in a resting state). Anyone who gains access to the systems cannot do anything with the data unless they have the keys./nEncryption \"in transit\": All transfers of personal data are encrypted by us. Thus, it cannot be intercepted during transmission./nBackups: We regularly backup all personal data and periodically check it./nLogging (Basic): We record when and by whom personal data is entered, changed or disclosed (audit trails). This ensures the traceability of the processing of personal data in the solution./nData deletion mechanisms: We have ensured with appropriate functions that we generally delete or anonymize personal data that we no longer need./n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n: /n"},{"$f":"ROW($B$128)","v":128},{"$f":"ROW($B$83)","v":83},null,null,{"$f":"ROW($B$117)","v":117},"Who?","When?","Status?",null,"Instructions"]
[null,null,null,{"$f":"ROW($A$168)","v":168},{"$f":"ROW($C$38)","v":38}]
["Note: Instructions for completing this DPIA and for the AI-assisted filling aid (optional, only in the Excel with macros) can be found at the end of this page, on the right and in the one pager and video right below. ",null,null,null,null,null,"FAQ",null,"Note: This section will not be printed and can be used for internal control of the DPIA."]
[]
["Organization (Controller):",null,"ACME Ltd.",null,null,null,null,null,null,null,null,null,"Indicate here the organization that is responsible for the project or data processing. This is the organization that defines the parameters of the processing of personal data (i.e. its purpose or means), alone or with others. In data protection terms this is the \"controller\". "]
["Department:",null,"Customer Support",null,null,null,null,null,null,null,null,null,"Here, add the area within the organization that is responsible for data processing or the project. This is not necessarily the department that technically implements the data processing."]
["Internally responsible person (owner):",null,"Emily Smith",null,null,null,null,null,null,null,null,null,"This is the person who is internally responsible for data processing or the project, i.e. the \"owner\". This is not the person who is responsible for the implementation, rather the person with the decision making power regarding the project."]
["Status of the DPIA:",null,"In progress; currently with the project manager",null,null,null,null,null,null,null,null,null,"Here, the status of the DPIA can be stated. This is deliberately a free text field that can be supplemented with further remarks."]
[]
["Project Name:",null,"VoiceID",null,null,null,null,null,null,null,null,null,"The name of the project does not have to be creative, it can be a project name, the name of an application, or simply a descriptive term like \"video surveillance\" or \"CRM\". Content-wise, this designation has no relevance."]
[]
["Activity according to the ROPA (if known):",null,"Customer Service",null,null,null,null,null,null,null,null,null,"If the processing activity being discussed here is already listed in the records of processing activities (ROPA), a corresponding reference can be entered here to make it easier to identify the project."]
[]
["1.","Description of the project"]
[]
["1.01","In which area data processing does take place or\nwhich business process is affected:","Handling calls in the call center",null,null,null,null,null,null,null,null,null,"Insert here a description of which area of the organization the data processing takes place, for example, for which process it should be carried out, which activities or processes it concerns or otherwise in which area of the organization the data is collected and processed. This helps to better understand the context of data processing."]
["1.02","What is planned:","This is about voice recognition: All conversations are recorded and processed by AI. The voice print is then stored in a database. With each call, a new voice print is created and this is compared with the stored voice print. The call center agent is shown if it matches.",null,null,null,null,null,null,null,null,null,"Describe here the data processing in its individual steps, including information on the origin of the data or how it is collected, what the data flows are and who receives which data, what happens with the data, how long and where it is stored. The more complex the data processing is, the more detailed the description should be. An outsider should be able to get a good picture of what is planned from the perspective of the data of the affected persons. This is about the \"what\" and \"how\" of data processing."]
["1.03","What interests are being pursued:","The voice print is intended to help the call center agent verify the identity of a caller to the call center and thus increase security.",null,null,null,null,null,null,null,null,null,"Describe here what is to be achieved with the data processing, i.e. what result is to be achieved and what interests and purposes are being pursued. So it's about the \"why\"."]
["1.04","What means and techniques are used:","A standard solution from the US manufacturer StarVoice Inc. is used, which we operate in the cloud here in Switzerland.",null,null,null,null,null,null,null,null,null,"List here which means and techniques are used for the project (e.g. specific methods, systems, services, applications)."]
["1.05","Which third parties are involved in the project and how:","The solution runs on Microsoft Azure by Microsoft Ireland Operations Ltd. Other third parties are not involved.",null,null,null,null,null,null,null,null,null,"List here those third parties who are to be involved in the data processing and in which role. Company names are not necessary here, but categories can be used (e.g. provider, regulatory authorities, group companies, advertising partners)."]
["1.06","Which data is processed (categories):","Voiceprint, a person's ID, voice recordings",null,null,null,null,null,null,null,null,null,"Add here the categories of personal data that will be processed during the data processing. If it is not clear whether some information is actually personal data, list it nevertheless. Not every detail of the categories needs to be listed. The aim is to get an impression of what kind of data the organization is dealing with in order to assess the associated risk."]
["1.07","Whose data is being processed (data subjects):","Caller",null,null,null,null,null,null,null,null,null,"List here which individuals are affected by the data processing, but only those whose data is concerned (i.e. data subjects). Here too, no names should be given, but categories (such as employees, customers, callers)."]
["1.08","Where the data is processed (country):","Switzerland",null,null,null,null,null,null,null,null,null,"List here the countries where the data is to be processed or possibly could be processed, including by remote access (so if, for example, someone from the USA could access the data, the USA should also be listed here). Clearly defined regions such as the EEA or Europe can also be used."]
["1.09","When the data processing should be realized:","In December 2023, a pilot is supposed to start with selected customers and the broad roll-out is to take place in March 2024.",null,null,null,null,null,null,null,null,null,"Add here when the data processing or the project should be implemented, possibly also indicating corresponding stages. This is not a mandatory field."]
["1.10","Further relevant aspects:",null,null,null,null,null,null,null,null,null,null,"This space is for further details that appear important for assessing the risks of the affected persons, but cannot be accommodated anywhere else."]
[]
["2.","Necessity / Proportionality"]
[]
["2.01","Why the data processing is necessary or why, from the perspective of the data subjects, there is no less intrusive approach:","The data processing is necessary to ensure the security of the caller's personal information and to prevent fraudulent activities. The voiceprint serves as a unique identifier, enhancing the verification process and thus reducing the risk of identity theft. There is no less intrusive approach as other verification methods like passwords or security questions can be easily compromised, while a voiceprint, being unique to each individual, offers a higher level of security.",null,null,null,null,null,null,null,null,null,"Here it is necessary to explain in a few sentences why data processing is necessary at all, because every processing of personal data carries a risk for the affected individuals. It should be justified why the goals that are to be achieved cannot also be achieved without data processing or with a less intrusive approach (intrusion is referring to the sphere of the affected individuals and their data). The reasons for this can also be of an economic nature."]
["2.02","Why data processing follows the principle of data minimization, is limited in time to what is necessary (storage limitation), and otherwise proportionate:","Data processing follows the principle of data minimization as only the required data, namely the voiceprint and person's ID, are captured during the call, neglecting any non-related personal information. The storage limitation principle is adhered to since voice prints are only maintained for the duration of the call and replaced with each new call, ensuring no long-term storage of personal information. Lastly, the process is proportionate as it's vital for improving call security and authentication, a legitimate concern, without intruding excessively on the data subject's privacy.",null,null,null,null,null,null,null,null,null,"Assuming that data processing itself is necessary, it should be described here whether the data processing itself is \"proportional\", i.e., it is limited to what is necessary to achieve the intended goals, what is really suitable for this, and what also appears reasonable or in the right proportion for the people concerned. Here, individual aspects of the planned data processing can also be addressed, such as data minimization, deletion of data after use, or other temporal or other limitations."]
[]
["3.","Measures taken to protect the affected individuals from disadvantages",null,null,null,null,null,null,"Who?","When?","Status?",null,"In this section, all the measures that the organization does or intends to do to protect the interests of the affected individuals and to comply with data protection or to prevent anything from going wrong with the data should be listed."]
[null,"Note: If you do not know which measures should be taken, consult the catalog (see link on the right) or start with the risk assessment in section 4. This will show you where there is a need."]
[]
[null,"Is the basic infrastructure assessed separately?","No, this is why this aspect is also evaluated here",null,null,null,null,null,null,null,null,null,"If a data processing or a project is based on an infrastructure (system, application, cloud platform etc.) that has already been separately checked, it can declared irrelevant for present purposes. This should be noted here."]
[]
[null,"What level of protection does the project require?","2 - Medium Protection Level (confidential data)",null,null,null,null,null,null,null,null,null,"Each project is to be assigned one of three protection levels depending on the sensitivity of the data and its processing. These determine the technical and organizational measures that are to be implemented at least according to the organization's specifications in the \"risk catalog\"."]
[]
[null,null,"1 - Low protection level","Note: The protection level defines the minimum measures that must be implemented (basic measures). The company determines the description (the texts on the left can be changed for this purpose)."]
[null,null,"2 - Medium Protection Level (confidential data)"]
[null,null,"3 - High protection level (high damage potential)",null,null,null,null,null,null,null,null,null,"The catalog of protection levels can be adjusted directly in Excel. Each line must start with 1, 2, or 3."]
[]
[null,{"$f":"'DPIA Measure Catalog'!$B$6","v":"Organizational Measures"},"Description and Effect","Explanations on implementation/status","Responsible","Status"]
[3]
[{"$f":"IF(OR($B46=\"(wählen)\",ISBLANK($B46)),\" \",MAX($A$45:$A45)+0.01)","v":3.01},"Training",{"$f":"IFERROR(VLOOKUP($B46,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We train the correct use of the solution to reduce the risk of errors in the processing of personal data."},null,null,null,{"$f":"IF(B46=\"(select)\",\"\",B46&\": \"&C46&\"/n\")","v":"Training: We train the correct use of the solution to reduce the risk of errors in the processing of personal data./n"}," ",null,null,null,null,"Here and in the following lines, a measure from the \"measure catalog\" can be selected. The text for the description and effect appears automatically (as defined in the catalog of measures). If a measure is missing, it can be added to the catalog of measures in the separate worksheet. While the text in the first two columns cannot be changed here, the third column can be used to explain how each measure is implemented.",null,"Unclear","Recommended","Planned","In progress","Implemented","Rejected"]
[{"$f":"IF(OR($B47=\"(wählen)\",ISBLANK($B47)),\" \",MAX($A$45:$A46)+0.01)","v":3.0199999999999996},"User Manual",{"$f":"IFERROR(VLOOKUP($B47,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We provide the employees with a user manual that shows them how to correctly use the solution and how it works. This reduces the risk of errors, which could be detrimental to the affected individuals."},null,null,null,{"$f":"IF(B47=\"(select)\",\"\",B47&\": \"&C47&\"/n\")","v":"User Manual: We provide the employees with a user manual that shows them how to correctly use the solution and how it works. This reduces the risk of errors, which could be detrimental to the affected individuals./n"}," "]
[{"$f":"IF(OR($B48=\"(wählen)\",ISBLANK($B48)),\" \",MAX($A$45:$A47)+0.01)","v":3.0299999999999994},"Authorization Concept",{"$f":"IFERROR(VLOOKUP($B48,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have established an authorization concept based on the \"need-to-know\" principle. In this way, we can limit data security risks and at the same time ensure the proportionality of processing concerning access rights."},null,null,null,{"$f":"IF(B48=\"(select)\",\"\",B48&\": \"&C48&\"/n\")","v":"Authorization Concept: We have established an authorization concept based on the \"need-to-know\" principle. In this way, we can limit data security risks and at the same time ensure the proportionality of processing concerning access rights./n"}," "]
[{"$f":"IF(OR($B49=\"(wählen)\",ISBLANK($B49)),\" \",MAX($A$45:$A48)+0.01)","v":3.0399999999999991},"Process for right of access",{"$f":"IFERROR(VLOOKUP($B49,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have defined who is responsible for dealing with access requests. This person knows what to do."},null,null,null,"Process for right of access: We have defined who is responsible for dealing with access requests. This person knows what to do./n"," "]
[{"$f":"IF(OR($B50=\"(wählen)\",ISBLANK($B50)),\" \",MAX($A$45:$A49)+0.01)","v":3.0499999999999989},"Process for deletion requests",{"$f":"IFERROR(VLOOKUP($B50,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have defined who is responsible for dealing with deletion requests. This person knows what to do."},null,null,null,"Process for deletion requests: We have defined who is responsible for dealing with deletion requests. This person knows what to do./n"," "]
[{"$f":"IF(OR($B51=\"(wählen)\",ISBLANK($B51)),\" \",MAX($A$45:$A50)+0.01)","v":3.0599999999999987},"Privacy notice",{"$f":"IFERROR(VLOOKUP($B51,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have outlined the relevant collection and other processing of personal data in a law-compliant privacy statement."},null,null,null,"Privacy notice: We have outlined the relevant collection and other processing of personal data in a law-compliant privacy statement./n"," "]
[{"$f":"IF(OR($B52=\"(wählen)\",ISBLANK($B52)),\" \",MAX($A$45:$A51)+0.01)","v":3.0699999999999985},"References to data collection",{"$f":"IFERROR(VLOOKUP($B52,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"When we collect personal data, we not only point this out to the affected individuals in the privacy notice, but also on forms, signs or other suitable ways that they can immediately recognize."},null,null,null,"References to data collection: When we collect personal data, we not only point this out to the affected individuals in the privacy notice, but also on forms, signs or other suitable ways that they can immediately recognize./n"," "]
[{"$f":"IF(OR($B53=\"(wählen)\",ISBLANK($B53)),\" \",MAX($A$45:$A52)+0.01)","v":3.0799999999999983},"Compliance check",{"$f":"IFERROR(VLOOKUP($B53,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have successfully had the relevant processing of personal data checked for its compliance with data protection."},null,null,null,"Compliance check: We have successfully had the relevant processing of personal data checked for its compliance with data protection./n"," "]
[{"$f":"IF(OR($B54=\"(wählen)\",ISBLANK($B54)),\" \",MAX($A$45:$A53)+0.01)","v":3.0899999999999981},"ISMS",{"$f":"IFERROR(VLOOKUP($B54,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have an Information Security Management System (ISMS). This ensures that information security, especially in relation to the project and the personal data processed with it, is regularly reviewed and improved as needed."},null,null,null,"ISMS: We have an Information Security Management System (ISMS). This ensures that information security, especially in relation to the project and the personal data processed with it, is regularly reviewed and improved as needed./n"," "]
[{"$f":"IF(OR($B55=\"(wählen)\",ISBLANK($B55)),\" \",MAX($A$45:$A54)+0.01)","v":3.0999999999999979},"Records of processing activities",{"$f":"IFERROR(VLOOKUP($B55,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We enter the data in our Records of Processing Activities (ROPA) and ensure that it is updated upon changes."},null,null,null,"Records of processing activities: We enter the data in our Records of Processing Activities (ROPA) and ensure that it is updated upon changes./n"," "]
[{"$f":"IF(OR($B56=\"(wählen)\",ISBLANK($B56)),\" \",MAX($A$45:$A55)+0.01)","v":3.1099999999999977},"Right to delete ensured",{"$f":"IFERROR(VLOOKUP($B56,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":"We have ensured that the personal data processed for the project can also be deleted or anonymized as far as legally required."},null,null,null,"Right to delete ensured: We have ensured that the personal data processed for the project can also be deleted or anonymized as far as legally required./n"," "]
[{"$f":"IF(OR($B57=\"(wählen)\",ISBLANK($B57)),\" \",MAX($A$45:$A56)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B57,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B58=\"(wählen)\",ISBLANK($B58)),\" \",MAX($A$45:$A57)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B58,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B59=\"(wählen)\",ISBLANK($B59)),\" \",MAX($A$45:$A58)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B59,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B60=\"(wählen)\",ISBLANK($B60)),\" \",MAX($A$45:$A59)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B60,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B61=\"(wählen)\",ISBLANK($B61)),\" \",MAX($A$45:$A60)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B61,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B62=\"(wählen)\",ISBLANK($B62)),\" \",MAX($A$45:$A61)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B62,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B63=\"(wählen)\",ISBLANK($B63)),\" \",MAX($A$45:$A62)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B63,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B64=\"(wählen)\",ISBLANK($B64)),\" \",MAX($A$45:$A63)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B64,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B65=\"(wählen)\",ISBLANK($B65)),\" \",MAX($A$45:$A64)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B65,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B66=\"(wählen)\",ISBLANK($B66)),\" \",MAX($A$45:$A65)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B66,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B67=\"(wählen)\",ISBLANK($B67)),\" \",MAX($A$45:$A66)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B67,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B68=\"(wählen)\",ISBLANK($B68)),\" \",MAX($A$45:$A67)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B68,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B69=\"(wählen)\",ISBLANK($B69)),\" \",MAX($A$45:$A68)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B69,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B70=\"(wählen)\",ISBLANK($B70)),\" \",MAX($A$45:$A69)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B70,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B71=\"(wählen)\",ISBLANK($B71)),\" \",MAX($A$45:$A70)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B71,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B72=\"(wählen)\",ISBLANK($B72)),\" \",MAX($A$45:$A71)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B72,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,{"$f":"IF(B72=\"(select)\",\"\",B72&\": \"&C72&\"/n\")","v":": /n"}," "]
[{"$f":"IF(OR($B73=\"(wählen)\",ISBLANK($B73)),\" \",MAX($A$45:$A72)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B73,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B74=\"(wählen)\",ISBLANK($B74)),\" \",MAX($A$45:$A73)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B74,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B75=\"(wählen)\",ISBLANK($B75)),\" \",MAX($A$45:$A74)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B75,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B76=\"(wählen)\",ISBLANK($B76)),\" \",MAX($A$45:$A75)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B76,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B77=\"(wählen)\",ISBLANK($B77)),\" \",MAX($A$45:$A76)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B77,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B78=\"(wählen)\",ISBLANK($B78)),\" \",MAX($A$45:$A77)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B78,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B79=\"(wählen)\",ISBLANK($B79)),\" \",MAX($A$45:$A78)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B79,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B80=\"(wählen)\",ISBLANK($B80)),\" \",MAX($A$45:$A79)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B80,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B81=\"(wählen)\",ISBLANK($B81)),\" \",MAX($A$45:$A80)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B81,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B82=\"(wählen)\",ISBLANK($B82)),\" \",MAX($A$45:$A81)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B82,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B83=\"(wählen)\",ISBLANK($B83)),\" \",MAX($A$45:$A82)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B83,INDIRECT('DPIA Measure Catalog'!$C$54),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[]
[null,"Remarks:"]
[]
[null,{"$f":"'DPIA Measure Catalog'!$B$56","v":"Technical measures"},"Description and Effect","Explanations on implementation/status","Responsible","Status",null,null,"Who?","When?","Status?"]
[]
[{"$f":"IF(OR($B89=\"(wählen)\",ISBLANK($B89)),\" \",MAX($A$45:$A88)+0.01)","v":3.1199999999999974},"Online access control",{"$f":"IFERROR(VLOOKUP($B89,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"Only authorized individuals can access the non-public personal data of the project. This is to prevent any abusive or otherwise uncontrolled use."},null,null,null,{"$f":"IF(B89=\"(select)\",\"\",B89&\": \"&C89&\"/n\")","v":"Online access control: Only authorized individuals can access the non-public personal data of the project. This is to prevent any abusive or otherwise uncontrolled use./n"}," ",null,null,null,null,"Here and in the following lines, a measure from the \"measure catalog\" can be selected. The text for the description and effect appears automatically (as defined in the catalog of measures). If a measure is missing, it can be added to the catalog of measures in the separate worksheet. While the text in the first two columns cannot be changed here, the third column can be used to explain how each measure is implemented."]
[{"$f":"IF(OR($B90=\"(wählen)\",ISBLANK($B90)),\" \",MAX($A$45:$A89)+0.01)","v":3.1299999999999972},"Physical access control",{"$f":"IFERROR(VLOOKUP($B90,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"Only authorized persons have physical access to the premises and facilities where personal data is processed. This prevents abusive or otherwise uncontrolled use."},null,null,null,{"$f":"IF(B90=\"(select)\",\"\",B90&\": \"&C90&\"/n\")","v":"Physical access control: Only authorized persons have physical access to the premises and facilities where personal data is processed. This prevents abusive or otherwise uncontrolled use./n"}," "]
[{"$f":"IF(OR($B91=\"(wählen)\",ISBLANK($B91)),\" \",MAX($A$45:$A90)+0.01)","v":3.139999999999997},"User authentication",{"$f":"IFERROR(VLOOKUP($B91,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We authenticate all users who want to access our systems. This helps us prevent abusive or otherwise uncontrolled use. This also serves for logging."},null,null,null,"User authentication: We authenticate all users who want to access our systems. This helps us prevent abusive or otherwise uncontrolled use. This also serves for logging./n"," "]
[{"$f":"IF(OR($B92=\"(wählen)\",ISBLANK($B92)),\" \",MAX($A$45:$A91)+0.01)","v":3.1499999999999968},"MFA for external access",{"$f":"IFERROR(VLOOKUP($B92,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"All users who want to externally access the systems with which the relevant personal data is processed have to authenticate themselves using multi-factor authentication."},null,null,null,"MFA for external access: All users who want to externally access the systems with which the relevant personal data is processed have to authenticate themselves using multi-factor authentication./n"," "]
[{"$f":"IF(OR($B93=\"(wählen)\",ISBLANK($B93)),\" \",MAX($A$45:$A92)+0.01)","v":3.1599999999999966},"MFA for privileged accesses",{"$f":"IFERROR(VLOOKUP($B93,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"All users who have elevated privileges with regard to the systems that process the personal data relevant must authenticate themselves using multi-factor authentication."},null,null,null,"MFA for privileged accesses: All users who have elevated privileges with regard to the systems that process the personal data relevant must authenticate themselves using multi-factor authentication./n"," "]
[{"$f":"IF(OR($B94=\"(wählen)\",ISBLANK($B94)),\" \",MAX($A$45:$A93)+0.01)","v":3.1699999999999964},"Encryption \"mobile\"",{"$f":"IFERROR(VLOOKUP($B94,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We encrypt mobile data carriers (including mobile computers) that contain personal data, so that an unauthorized person cannot do anything with it."},null,null,null,"Encryption \"mobile\": We encrypt mobile data carriers (including mobile computers) that contain personal data, so that an unauthorized person cannot do anything with it./n"," "]
[{"$f":"IF(OR($B95=\"(wählen)\",ISBLANK($B95)),\" \",MAX($A$45:$A94)+0.01)","v":3.1799999999999962},"Encryption \"at rest\"",{"$f":"IFERROR(VLOOKUP($B95,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We encrypt personal data when it is stored on the systems (i.e., in a resting state). Anyone who gains access to the systems cannot do anything with the data unless they have the keys."},null,null,null,"Encryption \"at rest\": We encrypt personal data when it is stored on the systems (i.e., in a resting state). Anyone who gains access to the systems cannot do anything with the data unless they have the keys./n"," "]
[{"$f":"IF(OR($B96=\"(wählen)\",ISBLANK($B96)),\" \",MAX($A$45:$A95)+0.01)","v":3.1899999999999959},"Encryption \"in transit\"",{"$f":"IFERROR(VLOOKUP($B96,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"All transfers of personal data are encrypted by us. Thus, it cannot be intercepted during transmission."},null,null,null,"Encryption \"in transit\": All transfers of personal data are encrypted by us. Thus, it cannot be intercepted during transmission./n"," "]
[{"$f":"IF(OR($B97=\"(wählen)\",ISBLANK($B97)),\" \",MAX($A$45:$A96)+0.01)","v":3.1999999999999957},"Backups",{"$f":"IFERROR(VLOOKUP($B97,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We regularly backup all personal data and periodically check it."},null,null,null,"Backups: We regularly backup all personal data and periodically check it./n"," "]
[{"$f":"IF(OR($B98=\"(wählen)\",ISBLANK($B98)),\" \",MAX($A$45:$A97)+0.01)","v":3.2099999999999955},"Logging (Basic)",{"$f":"IFERROR(VLOOKUP($B98,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We record when and by whom personal data is entered, changed or disclosed (audit trails). This ensures the traceability of the processing of personal data in the solution."},null,null,null,"Logging (Basic): We record when and by whom personal data is entered, changed or disclosed (audit trails). This ensures the traceability of the processing of personal data in the solution./n"," "]
[{"$f":"IF(OR($B99=\"(wählen)\",ISBLANK($B99)),\" \",MAX($A$45:$A98)+0.01)","v":3.2199999999999953},"Data deletion mechanisms",{"$f":"IFERROR(VLOOKUP($B99,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":"We have ensured with appropriate functions that we generally delete or anonymize personal data that we no longer need."},null,null,null,"Data deletion mechanisms: We have ensured with appropriate functions that we generally delete or anonymize personal data that we no longer need./n"," "]
[{"$f":"IF(OR($B100=\"(wählen)\",ISBLANK($B100)),\" \",MAX($A$45:$A99)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B100,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B101=\"(wählen)\",ISBLANK($B101)),\" \",MAX($A$45:$A100)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B101,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B102=\"(wählen)\",ISBLANK($B102)),\" \",MAX($A$45:$A101)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B102,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B103=\"(wählen)\",ISBLANK($B103)),\" \",MAX($A$45:$A102)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B103,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B104=\"(wählen)\",ISBLANK($B104)),\" \",MAX($A$45:$A103)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B104,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B105=\"(wählen)\",ISBLANK($B105)),\" \",MAX($A$45:$A104)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B105,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B106=\"(wählen)\",ISBLANK($B106)),\" \",MAX($A$45:$A105)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B106,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B107=\"(wählen)\",ISBLANK($B107)),\" \",MAX($A$45:$A106)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B107,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B108=\"(wählen)\",ISBLANK($B108)),\" \",MAX($A$45:$A107)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B108,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B109=\"(wählen)\",ISBLANK($B109)),\" \",MAX($A$45:$A108)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B109,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B110=\"(wählen)\",ISBLANK($B110)),\" \",MAX($A$45:$A109)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B110,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B111=\"(wählen)\",ISBLANK($B111)),\" \",MAX($A$45:$A110)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B111,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B112=\"(wählen)\",ISBLANK($B112)),\" \",MAX($A$45:$A111)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B112,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B113=\"(wählen)\",ISBLANK($B113)),\" \",MAX($A$45:$A112)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B113,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B114=\"(wählen)\",ISBLANK($B114)),\" \",MAX($A$45:$A113)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B114,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B115=\"(wählen)\",ISBLANK($B115)),\" \",MAX($A$45:$A114)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B115,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B116=\"(wählen)\",ISBLANK($B116)),\" \",MAX($A$45:$A115)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B116,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[{"$f":"IF(OR($B117=\"(wählen)\",ISBLANK($B117)),\" \",MAX($A$45:$A116)+0.01)","v":" "},null,{"$f":"IFERROR(VLOOKUP($B117,INDIRECT('DPIA Measure Catalog'!$C$96),2,FALSE),\"\")","v":""},null,null,null,": /n"," "]
[]
[null,"Remarks:"]
[]
[]
["4.","Remaining risks of negative consequences for the affected persons despite the above measures",null,null,null,null,null,null,null,null,null,null,"This section describes what can go wrong in terms of data processing and how that can have unintended negative consequences for the people affected (i.e. the data subjects). The 1st column should indicate the risk scenario, i.e., an uncertain cause (something that can go wrong) and the negative consequences that this can entail. The 2nd column should specify what is being done to prevent this (from the measures listed above), and the 3rd column should assess the residual risk after all measures have been taken. This can be further specified in the 4th and 5th columns by making an appropriate selection. Excel then calculates the mathematical risk."]
[null,null,null," "]
[null,"Note: If the identified risks appear to be too high, or if it turns out that there are additional measures for mitigating them, then these should be entered above under no. 3 and taken into account here in the risk assessment."]
[]
[null,"Possible unintended negative consequences","How we mitigate the risk","How we assess the residual risk","Possible consequences for the person","Probability of occurrence (all in all)","Risk\r\n(1-16)",null,"Who?","When?","Status?"]
[4]
[{"$f":"IF($B128=\"\",\" \",MAX($A$45:$A127)+0.01)","v":4.01},"Personal data used in the project is leaked due to an error or intentionally to unauthorized third parties. They misuse it to the detriment of the affected individuals.","- Authorization Concept: Limiting data access based on the \"need-to-know\" principle minimizes the risk of unauthorized access and misuse.\r\n- Encryption \"at rest\": Encrypting stored personal data ensures that even if data is accessed without authorization, it cannot be read or misused without the decryption keys.\r\n- Encryption \"in transit\": Encrypting data during transmission prevents interception and unauthorized access during data transfer.\r\n- MFA for privileged accesses: Implementing multi-factor authentication for users with elevated privileges significantly reduces the risk of unauthorized access to sensitive data.\r\n- Logging (Basic): Recording when and by whom data is accessed or modified ensures accountability and traceability, helping to detect and investigate any unauthorized access promptly.","If personal data, such as a voice print, is leaked and misused, an unauthorized individual could potentially impersonate the caller, gaining access to sensitive information, financial accounts, or other personal services, leading to identity theft and financial loss. For instance, an attacker using the stolen voice print might successfully validate their identity in another call center interaction, resulting in unauthorized transfers of funds from the victim’s bank account or unauthorized access to other critical personal accounts. The likelihood of such an incident occurring is very low due to robust security measures in place, but the impact on the individual would be substantial, including financial damage, emotional distress, and a time-consuming recovery process.","Substantial","Very low",{"$f":"IF(ISERROR(VLOOKUP($E128,$C$171:$E$174,3,FALSE)*VLOOKUP($F128,$D$171:$E$174,2,FALSE)),\"\",IF(VLOOKUP($E128,$C$171:$E$174,3,FALSE)*VLOOKUP($F128,$D$171:$E$174,2,FALSE)>=$G$172,$G$177,IF(VLOOKUP($E128,$C$171:$E$174,3,FALSE)*VLOOKUP($F128,$D$171:$E$174,2,FALSE)>=$G$171,$G$176,$G$175))&CHAR(10)&\"(\"&VLOOKUP($E128,$C$171:$E$174,3,FALSE)*VLOOKUP($F128,$D$171:$E$174,2,FALSE)&\")\")","v":"Low\n(3)"},null,null,null,null,null,"For data processing or the project, a risk scenario with its assessment should be listed for each line from here on. These could be generic risks that are possible with any data processing (e.g., that the data may fall into the hands of unauthorized persons or be lost), but also case-specific accidents, abuses, or the like. The latter category includes systemic risks, i.e., problems that arise, for example, from the interaction of the various elements. These may not be immediately apparent at first glance. It may therefore be worthwhile to fill out this part in a small workshop, in which everyone contributes their ideas about what problems data processing the project could potentially bring with it for the affected persons in the medium and long term. However, the time period for thr risk assessment is given below. Each risk assessment must always refer to a specific time period. As further assistance, there is a separate worksheet with a series of predefined standardized risk scenarios that can be \"copy & pasted\" into this risk assessment. They should be adapted to the specific circumstances where necessary."]
[{"$f":"IF($B129=\"\",\" \",MAX($A$45:$A128)+0.01)","v":4.0199999999999996},"Personal data used in the project is leaked due to an error or intentionally to an unauthorized internal person. This person misuses it to the detriment of the affected individuals.",null,null,"Manageable","Low",{"$f":"IF(ISERROR(VLOOKUP($E129,$C$171:$E$174,3,FALSE)*VLOOKUP($F129,$D$171:$E$174,2,FALSE)),\"\",IF(VLOOKUP($E129,$C$171:$E$174,3,FALSE)*VLOOKUP($F129,$D$171:$E$174,2,FALSE)>=$G$172,$G$177,IF(VLOOKUP($E129,$C$171:$E$174,3,FALSE)*VLOOKUP($F129,$D$171:$E$174,2,FALSE)>=$G$171,$G$176,$G$175))&CHAR(10)&\"(\"&VLOOKUP($E129,$C$171:$E$174,3,FALSE)*VLOOKUP($F129,$D$171:$E$174,2,FALSE)&\")\")","v":"Low\n(4)"}]
[{"$f":"IF($B130=\"\",\" \",MAX($A$45:$A129)+0.01)","v":4.0299999999999994},"Personal data used in the project is accidentally deleted in whole or in part. This leads to a disadvantage for the affected individuals.",null,null,null,null,""]
[{"$f":"IF($B131=\"\",\" \",MAX($A$45:$A130)+0.01)","v":4.0399999999999991},"Personal data used in the project is partially or completely deleted by an attacker. This leads to a disadvantage for the affected individuals.",null,null,null,null,""]
[{"$f":"IF($B132=\"\",\" \",MAX($A$45:$A131)+0.01)","v":4.0499999999999989},"The solution or the systems with which we process the personal data used in the project no longer allows us to access or otherwise process the data. This leads to a disadvantage for the affected individuals.",null,null,null,null,""]
[{"$f":"IF($B133=\"\",\" \",MAX($A$45:$A132)+0.01)","v":4.0599999999999987},"Personal data used in the project is manipulated by an external attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.",null,null,null,null,""]
[{"$f":"IF($B134=\"\",\" \",MAX($A$45:$A133)+0.01)","v":4.0699999999999985},"Personal data used in the project is manipulated by an internal attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.",null,null,null,null,""]
[{"$f":"IF($B135=\"\",\" \",MAX($A$45:$A134)+0.01)","v":4.0799999999999983},"Personal data used in the project is not updated due to an error in the solution, system, or operation, partially deleted or otherwise falsified, which we do not notice immediately and which in turn leads to a disadvantage for the affected persons.",null,null,null,null,""]
[{"$f":"IF($B136=\"\",\" \",MAX($A$45:$A135)+0.01)","v":4.0899999999999981},"The affected individuals do not realize that we are collecting their personal data or what we are doing with it. This lack of transparency leads to distrust and discomfort among these individuals and other disadvantages for them.",null,null,null,null,""]
[{"$f":"IF($B137=\"\",\" \",MAX($A$45:$A136)+0.01)","v":4.0999999999999979},"Personal data used in the project is misused by us compared to our original communication, which leads to distrust and discomfort by the affected persons and other disadvantages for them.",null,null,null,null,""]
[{"$f":"IF($B138=\"\",\" \",MAX($A$45:$A137)+0.01)","v":4.1099999999999977},"Personal data used in the project is used contrary to applicable rules by a third party for purposes other than intended, which leads to distrust and discomfort by the affected persons and other disadvantages for them.",null,null,null,null,""]
[{"$f":"IF($B139=\"\",\" \",MAX($A$45:$A138)+0.01)","v":4.1199999999999974},"We are unable to satisfy an affected individual's access right, i.e. the information about their relevant personal data and the other aspects of data processing that they may ask us about or request. As a result, they cannot properly enforce their legal rights to ensure their data protection.",null,null,null,null,""]
[{"$f":"IF($B140=\"\",\" \",MAX($A$45:$A139)+0.01)","v":4.1299999999999972},"We are unable to delete the data of an affected individual at its request, even though we should do so. This leads to discomfort among the affected individuals and other disadvantages for them.",null,null,null,null,""]
[{"$f":"IF($B141=\"\",\" \",MAX($A$45:$A140)+0.01)","v":4.139999999999997},"We are unable to correct the data of an affected individual at ist request, even though we should do this. This leads to discomfort of the affected individuals and other disadvantages for them, because we process incorrect or incomplete data about them.",null,null,null,null,""]
[{"$f":"IF($B142=\"\",\" \",MAX($A$45:$A141)+0.01)","v":4.1499999999999968},"We are unable to delete the personal data no longer needed. This leads to such data being misused to the detriment of the affected individuals or they can fall into the hands of unauthorized persons, with all the consequences of such an incident.",null,null,null,null,""]
[{"$f":"IF($B143=\"\",\" \",MAX($A$45:$A142)+0.01)","v":4.1599999999999966},"Our data processing has errors or gaps. This leads to affected individuals suffering financial losses or disadvantages.",null,null,null,null,""]
[{"$f":"IF($B144=\"\",\" \",MAX($A$45:$A143)+0.01)","v":4.1699999999999964},"Our data processing has errors or gaps. This leads to services being denied to affected individuals in an unintended manner.",null,null,null,null,""]
[{"$f":"IF($B145=\"\",\" \",MAX($A$45:$A144)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B146=\"\",\" \",MAX($A$45:$A145)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B147=\"\",\" \",MAX($A$45:$A146)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B148=\"\",\" \",MAX($A$45:$A147)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B149=\"\",\" \",MAX($A$45:$A148)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B150=\"\",\" \",MAX($A$45:$A149)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B151=\"\",\" \",MAX($A$45:$A150)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B152=\"\",\" \",MAX($A$45:$A151)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B153=\"\",\" \",MAX($A$45:$A152)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B154=\"\",\" \",MAX($A$45:$A153)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B155=\"\",\" \",MAX($A$45:$A154)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B156=\"\",\" \",MAX($A$45:$A155)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B157=\"\",\" \",MAX($A$45:$A156)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B158=\"\",\" \",MAX($A$45:$A157)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B159=\"\",\" \",MAX($A$45:$A158)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B160=\"\",\" \",MAX($A$45:$A159)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B161=\"\",\" \",MAX($A$45:$A160)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B162=\"\",\" \",MAX($A$45:$A161)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B163=\"\",\" \",MAX($A$45:$A162)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B164=\"\",\" \",MAX($A$45:$A163)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B165=\"\",\" \",MAX($A$45:$A164)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B166=\"\",\" \",MAX($A$45:$A165)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B167=\"\",\" \",MAX($A$45:$A166)+0.01)","v":" "},null,null,null,null,null,""]
[{"$f":"IF($B168=\"\",\" \",MAX($A$45:$A167)+0.01)","v":" "},null,null,null,null,null,""]
[]
[null,{"$f":"\"Assessment of the risk (next \"&$G$174&\" years):\"","v":"Assessment of the risk (next 3 years):"},"Consequences for the affected persons","Probability of these consequences"]
[null,null,"Minor","Very low",1,"Medium:",5,null,"          Meaning:","Minor = inconveniences that the affected individuals can cope with"]
[null,"* Select the desired cell before clicking; you can then also use \"DPIA Proposal\" in the context menu.","Manageable","Low",2,"High:",12,null,null,"Manageable = material inconveniences that the affected individuals can still cope with some effort."]
[null,null,"Substantial","Medium",3,null,null,null,null,"Substantial = significant inconveniences that affected individuals can only handle with serious difficulty."]
[null,"† Only works with newer versions of Excel","Gross","High",4,"Years:",3,null,null,"Gross = significant or even irreversible inconveniences that those affected cannot cope with"]
[null,null,null,"The texts of the four levels can be changed.",null,null,"Low"]
[null,"Examples of possible unintended negative consequences for affected individuals:",null,null,null,null,"Medium"]
[null,null,null,null,null,null,"High"]
[null,"Physical & psychological consequences","Health & other physical consequences","- Health risks\r\n- Stalking\r\n- Persecution, violent crime"]
[null,null,"Impairment of mental health","- Discomfort, oppressive feeling, stress\r\n- Depression, anxiety, trauma"]
[null,"Material & economic consequences","Professional Disadvantages","- Disadvantages in the application process or promotions\r\n- Warnings, job loss\r\n- Inability to practice profession"]
[null,null,"Financial damages","- Identity theft and fraud\r\n- Misuse of payment information\r\n- Loss of credit, bonus points, vouchers, etc.\r\n- Price discrimination, denial of a commercial service\r\n- Reduction of state benefits\r\n- Administrative efforts and fees\r\n- Extortion and ransom demands"]
[null,"Intangible Consequences","Societal and social disadvantages","- Exposure, defamation, loss of reputation\n- Bullying, stigmatization, social discrimination\n- Exclusion from services and offers, curtailing of social participation\n- Renunciation of personal development or exercise of rights for fear of negative consequences"]
[null,null,"Invasion of privacy","- Loss of control over \"personal data\"\r\n- \"Uncanny experience\" of personal information becoming known\r\n- Feeling of being observed or \"being followed\""]
[null,null,null,null,null,null,"Source: Migros"]
[]
["5.","Measures that have been considered, but not implemented (optional)"]
[5]
[null,"Measure","Reason why not implemented",null,null,null,null,null,"Who?","When?","Status?"]
[]
[{"$f":"IF($B190=\"\",\" \",MAX($A$186:$A189)+0.01)","v":" "},null,null,null,null,null,null,null,null,null,null,null,"Here and on the following lines, there is the option of listing those measures that were considered or proposed, but ultimately it was decided not to implement them. This can preempt questions and criticism, especially if there is a good reason for the decision."]
[{"$f":"IF($B191=\"\",\" \",MAX($A$186:$A190)+0.01)","v":" "}]
[{"$f":"IF($B192=\"\",\" \",MAX($A$186:$A191)+0.01)","v":" "}]
[{"$f":"IF($B193=\"\",\" \",MAX($A$186:$A192)+0.01)","v":" "}]
[{"$f":"IF($B194=\"\",\" \",MAX($A$186:$A193)+0.01)","v":" "}]
[{"$f":"IF($B195=\"\",\" \",MAX($A$186:$A194)+0.01)","v":" "}]
[{"$f":"IF($B196=\"\",\" \",MAX($A$186:$A195)+0.01)","v":" "}]
[{"$f":"IF($B197=\"\",\" \",MAX($A$186:$A196)+0.01)","v":" "}]
[{"$f":"IF($B198=\"\",\" \",MAX($A$186:$A197)+0.01)","v":" "}]
[{"$f":"IF($B199=\"\",\" \",MAX($A$186:$A198)+0.01)","v":" "}]
[]
["6.","Final assessment"]
[null,null,null,null,null,null,null,null,"Who?","When?","Status?"]
[6.01,"Are there high risks?",{"$f":"IF(ISERROR(FIND(\"High\",_xlfn.CONCAT($G$128:$G$168))),\"No\",\"Yes\")","v":"No"},{"$f":"IF($C$203=\"Yes\",\"  (DPIA has to be submitted to the supervisory authority for consultation!)\",\"\")","v":""},null,null,null,null,null,null,null,null,"This field is automatically filled based on the above risk analysis."]
[]
["6.02","Comments by affected persons (if applicable):",null,null,null,null,null,null,null,null,null,null,"If possible, people affected by the data processing or the project should also be asked what they think of the data processing or the project. Their views can be recorded here."]
["6.03","Comments by the Data Protection Officer:",null,null,null,null,null,null,null,null,null,null,"A DPIA is usually filled out by the owner of the data processing or the \"business\". Therefore, it makes sense to also invite the data protection office to comment. The comments can be recorded here."]
["6.04","Comments by the Supervisory Authority (if applicable):",null,null,null,null,null,null,null,null,null,null,"If, despite all measures, high risks still exist, the data processing or the project must be presented to the supervisory authority for comment (in Switzerland alternatively also to a \"data protection advisor\" in the sense of the law). Here, the resulting comment can be recorded."]
["6.05","Owner's response to the comments:",null,null,null,null,null,null,null,null,null,null,"The owner of the data processing can comment upon on the opinions of other bodies, e.g. whether they would like to implement any recommendations or not and why."]
[]
["6.06","Decision on the project:","(select)","Person, Date:",null,null,null,null,null,null,null,null,"Once the DPIA is carried out, the owner of the data processing should decide whether the project can be implemented or not and briefly justify this accordingly."]
[null,"Justification/Comment:"]
[]
["Note:",{"$f":"\"This DPIA has to be retained for at least two years following the end of the processing activitiy. It shall be repeated or updated after \"&$G$174&\" years or in case of relevant changes.\"","v":"This DPIA has to be retained for at least two years following the end of the processing activitiy. It shall be repeated or updated after 3 years or in case of relevant changes."}]
[]
["This DPIA template can be used free of charge; with exceptions regarding the content of the fields and a potential API key, the Creative Commons \"Attribution-NoDerivatives 4.0 International\" (CC BY-ND 4.0) applies. The contents in the fill-in fields can be freely modified and are not subject to any license restrictions; additional lines can also be added. The template is available in its current version at vud.ch/dpia and at www.rosenthal.ch/downloads/vud_dpia.xlsx and www.rosenthal/downloads/vud_dpia.xlsm. This does not constitute legal advice. The template is provided without warranty. Use is at your own risk. However, we are happy to receive feedback for improvement. Many thanks to all who have already contributed their input to improve this template and the action and risk catalog, especially the involved members of the VUD, David Vasella (Walder & Wyss), Maria Winkler (IT Law & Consulting) and Christoph Schnueriger (VISCHER).",null,null,null,null,null,null,null,null,null,null,null,"Instructions for machine translation of the DPIA: \n\n1. On the \"config\" worksheet, select the best model you have available and reduce the temperature appropriately (0.5 or lower).\n2. Press the button on the left. There is no reaction.\n3. Remove the protection on this sheet and the sheet with the catalog of measures.\n4. In the sheet with the catalog of measures, select the Translate2 and Translate3 area (or the cells that are to be translated) and start the desired translation function via the context menu. The translation will be running. If it aborts with a runtime error, this is because the OpenAI API did not react.\n5. In the main sheet, select the Translate1 area (or the relevant cells) and translate them as well. \n\nAttention: The translation cannot be undone with \"Undo\". Save a backup copy beforehand."]
["Author & Developer: David Rosenthal (drosenthal@vischer.com, VISCHER Legal Innovation Lab); all rights reserved. A project of the Swiss Association for Corporate Data Protection (VUD)."]
[]
["Instructions: A Data Protection Impact Assessment (DPIA) must be conducted when a planned data processing operation is likely to pose high risks to the individuals involved. Risks refer to unintended negative effects on the data subjects (i.e. the individuals affected). Risks to the person conducting the data processing are not relevant in a DPIA. Within the organization, the DPIA must be carried out and the risk assessments be made by the person responsible for the data processing activity; a data protection officer can provide advice. In the first step, the project must be described according to the information above (by data we mean personal data, not other data). In the second step, it must be explained why the data processing is really necessary as planned and proportionate. In a third step, the measures that will be taken to protect the rights and interests of the persons affected by the data processing are to be determined and documented. These can be technical or organizational measures. A second worksheet provides a catalog of possible measures. Those measures that have an X are those measures (e.g., instructions) that the organization has defined to be the minimum measures for the selected level of protection of the project (the selection of minimum measures can be defined by each organization, and it can do so for three levels of protection it can, as well, define itself). The DPIA is filled out in such a way that the actual measures taken or planned are selected from the catalog in the respective section on the main sheet. If a measure is missing in the selection, it can be added to the measure catalog. Additional information can be provided in the \"Remarks\" column on the main sheet. In the macro version of the DPIA, the minimum measures for the selected level of protection can be transferred to the main sheet automatically. In a fourth step, it must finally be checked which residual risks still exist despite the measures taken and planned. The respective fields must be filled in for this. To do so, the person who completes this part of the DPIA should imagine what could go wrong with the data processing that could have an unintended negative effect on the data subjects, i.e., those individuals whose personal data is being processed. Things can always happen, but only those negative developments (causes or scenarios and consequences) that are reasonably realistic should be considered (e.g., successful hacker attack and publication of data in the darknet). If such realistic scenarios exist, it must be assessed what the worst realistic consequences are (= severity) and how probable it is that a) the scenario occurs and b) it has these negative consequences (= probability). This then results in the residual risk (severity x probability). The residual risk is automatically shown as soon as the severity and probability has been selected. Furthermore, it must be stated which measures have been taken to prevent or mitigate the occurrence of the scenario and its negative consequences. Finally, it must be justified or described why the residual risk has been assessed at the levels stated. During this exercise, it will regularly occur that upon reflection on possible negative consequences, one will realize that further measures are needed, which can then be entered as in the third step and considered there (i.e. listed in the list of measures). For the sake of simplicity, this form for a DPIA does not differentiate between gross (or inherent) and net (residual) risk (i.e., risk before and after measures); this approach is often found in DPIAs, but it is not practical, unclear and difficult to handle. To facilitate determining possible risks, a separate worksheet contains a risk catalog with various \"standard\" risks. They can be manually copied (copy & paste) into the main sheet, as far as they are deemed appropriate; they can be adapted if necessary. When completing this section, the AI assistant (see below) can be used to suggest additional, specific risks, but also to formulate possible mitigating measures and propose risk assessments that can then be adapted manually. In an optional fifth step those technical and organizational measures can be listed that are intentionally not implemented, including the reason why they are omitted. The measures must be entered manually here. In a sixth step, a final assessment must be made. If one or more high risks are present (which is automatically shown), the DPIA must be presented to the supervisory authority (or in Switzerland to a possibly appointed data protection advisor in the sense of the CH FADP). The form can be adjusted to determine as of which value there is deemed to be a medium or high risk, as well as the four levels for classifying severity and probability. "]
["AI Assistance: This form exists in a version with an AI-assistant to support completion. The AI models from OpenAI (as used by \"ChatGPT\") are used for this. In this version, certain columns above the relevant table have a button. When the relevant field is selected (e.g., \"How we assess the residual risk\") and the button is pressed, an AI generates a possible answer based on the description of the processing activity. However, the result must be checked and adjusted if necessary. To make the AI operational, an API key from OpenAI must be inserted in advance on the \"Config\" worksheet, otherwise the use of the fill-in assistance will result in an error. This key can be obtained for free with a starting credit after registration on openai.com and entered in the \"Config\" worksheet. The prompts used for the query are also stored there. They can be adjusted if the answers do not fit. The prompts sent to the AI are composed of various elements, including variable ones, depending on the question. Attention: The AI version of this DPIA uses Visual Basic macros. Depending on the security settings, these are blocked or not executable in certain companies and cannot be sent via email. Therefore, please consult with the internal IT department in advance."]
["Attention: The Excel worksheets are protected so that no changes are possible outside the entry fields. The protection can be lifted without a password."]
[]
["The VBA code contained in the macro version of this Excel workbook (.xlsm) has been signed by VISCHER AG. If required, the certificate can be downloaded from www.rosenthal.ch."]

{"sheet":"DPIA Measure Catalog","index":1,"n_rows":107,"n_cols":8,"rows_kept":107,"cut":false,"hidden":false,"merged":[[103,0,103,7],[0,0,0,2],[98,2,98,7],[101,2,101,7],[96,0,96,2],[5,3,5,5],[55,3,55,5]]}
[{"$f":"'DPIA Main'!$A$1","v":"Data Protection Impact Assessment (DPIA)"},null,null,{"$f":"\"C\"&ROW($C$102)","v":"C102"},{"$f":"ROW($C$8)","v":8},{"$f":"ROW($C$58)","v":58}]
[{"$f":"'DPIA Main'!$A$2","v":"Version 22.9.2024 - Private Sector CH-FADP/GDPR"},null,null,null,{"$f":"ROW($C$52)","v":52},{"$f":"ROW($C$94)","v":94}]
[]
["Catalog of possible measures for the protection of affected individuals",null,null,null,null,null,null,"Back to the main sheet"]
[]
["No.","Organizational Measures","Description and effect","Mandatory as per protection level",null,null,"Selected","When to use and examples"]
[0,"(wählen)",{"$f":"\" \"","v":" "},1,2,3]
[{"$f":"IF(ISBLANK($B8),\"\",MAX($A$7:A7)+1)","v":1},"Training","We train the correct use of the solution to reduce the risk of errors in the processing of personal data.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B8)>0,\"X\",\" \")","v":"X"},"This can be done individually, through a webinar or a standardized training."]
[{"$f":"IF(ISBLANK($B9),\"\",MAX($A$7:A8)+1)","v":2},"Instruction","We have a directive that defines the correct use of the solution, thus reducing the risk of errors in the processing of personal data, but also counteracts misuse (e.g., misappropriation).",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B9)>0,\"X\",\" \")","v":" "},"A (binding) directive is particularly important in those cases where the personal data being processed in the solution could be misused by the employees."]
[{"$f":"IF(ISBLANK($B10),\"\",MAX($A$7:A9)+1)","v":3},"User Manual","We provide the employees with a user manual that shows them how to correctly use the solution and how it works. This reduces the risk of errors, which could be detrimental to the affected individuals.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B10)>0,\"X\",\" \")","v":"X"},"It can be done online or on paper, within the system or separately (e.g., through a leaflet). It differs from training in that the user can read the instructions at any time."]
[{"$f":"IF(ISBLANK($B11),\"\",MAX($A$7:A10)+1)","v":4},"Authorization Concept","We have established an authorization concept based on the \"need-to-know\" principle. In this way, we can limit data security risks and at the same time ensure the proportionality of processing concerning access rights.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B11)>0,\"X\",\" \")","v":"X"},"The \"need-to-know\" principle is prescribed due to the principle of proportionality, which states that processing should be limited to what is necessary. Access to personal data should only be given to those who really need it for their task. If necessary, access should be configured specifically for individual user profiles."]
[{"$f":"IF(ISBLANK($B12),\"\",MAX($A$7:A11)+1)","v":5},"Confidentiality obligation","We ensure that individuals with access to non-public personal data are subject to a legal or contractual obligation of confidentiality, in order to protect the personal data from unwanted or unauthorized disclosure.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B12)>0,\"X\",\" \")","v":" "},"All employees may already be subject to a \"simple\" confidentiality obligation under their employment contract. If necessary, it can be supplemented by an additional confidentiality declaration."]
[{"$f":"IF(ISBLANK($B13),\"\",MAX($A$7:A12)+1)","v":6},"Right of instruction","We have a right to give instructions to the persons who can process personal data for us.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B13)>0,\"X\",\" \")","v":" "},"Employers already have a right of instruction vis-à-vis employees under their employment contracts. For contractors and other providers, such a right can be established by means of a contract. It should be expressly referred to therein."]
[{"$f":"IF(ISBLANK($B14),\"\",MAX($A$7:A13)+1)","v":7},"Contract governing the processing","We have contractually regulated the processing of personal data with the parties involved. In this way, we ensure that the data is only processed as permitted.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B14)>0,\"X\",\" \")","v":" "},"When third parties who have access to personal data are involved in a project , it should be checked whether a contract should be concluded with them to control the security of the data but also the use of the data, as well as to record mutual responsibilities (a \"who-does-what\" contract)."]
[{"$f":"IF(ISBLANK($B15),\"\",MAX($A$7:A14)+1)","v":8},"Emergency Plan","We have an emergency plan, i.e., if the data security of the solution or personal data (confidentiality, integrity, availability) is no longer guaranteed.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B15)>0,\"X\",\" \")","v":" "},"In the event of a significant data security breach, the systems used for the solution may no longer be available or other unusual measures may be necessary, such as the involvement of experts. For this, every business should define possible emergency scenarios and develop or document appropriate measures and information."]
[{"$f":"IF(ISBLANK($B16),\"\",MAX($A$7:A15)+1)","v":9},"Process for right of access","We have defined who is responsible for dealing with access requests. This person knows what to do.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B16)>0,\"X\",\" \")","v":"X"},"Such access requests can be made by affected persons at any time according to law. However, the law also provides exceptions in which an access request does not have to be or cannot be fully complied with."]
[{"$f":"IF(ISBLANK($B17),\"\",MAX($A$7:A16)+1)","v":10},"Process for deletion requests","We have defined who is responsible for dealing with deletion requests. This person knows what to do.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B17)>0,\"X\",\" \")","v":"X"},"Affected persons can request deletion of their personal data at any time according to the law. However, the law also provides exceptions where a deletion request does not have to be or cannot be fully complied with."]
[{"$f":"IF(ISBLANK($B18),\"\",MAX($A$7:A17)+1)","v":11},"Process for correction requests","We have defined who is responsible for dealing with correction requests. This person knows what to do.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B18)>0,\"X\",\" \")","v":" "},"Such correction requests can be made by affected persons at any time according to law. However, the law also provides exceptions in which a requested correction or adjustment of personal data does not have to be complied with completely or at all."]
[{"$f":"IF(ISBLANK($B19),\"\",MAX($A$7:A18)+1)","v":12},"Process for other data subject requests","We have defined who is responsible for other requests from affected persons. This person knows what to do.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B19)>0,\"X\",\" \")","v":" "},"According to law, these can be, for example, requests for the release of data for further use (data portability)."]
[{"$f":"IF(ISBLANK($B20),\"\",MAX($A$7:A19)+1)","v":13},"Privacy notice","We have outlined the relevant collection and other processing of personal data in a law-compliant privacy statement.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B20)>0,\"X\",\" \")","v":"X"},"Subject to the exceptions under Art. 20 CH-FADP, there is a legal obligation (Art. 19 CH-FADP). The same is true for the GDPR."]
[{"$f":"IF(ISBLANK($B21),\"\",MAX($A$7:A20)+1)","v":14},"References to data collection","When we collect personal data, we not only point this out to the affected individuals in the privacy notice, but also on forms, signs or other suitable ways that they can immediately recognize.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B21)>0,\"X\",\" \")","v":"X"},"This is required by the principle of transparency. However, there is no prescribed special form for this."]
[{"$f":"IF(ISBLANK($B22),\"\",MAX($A$7:A21)+1)","v":15},"Compliance check","We have successfully had the relevant processing of personal data checked for its compliance with data protection.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B22)>0,\"X\",\" \")","v":"X"},"In such a check, the processing principles as well as the further requirements of the law are examined. A data protection impact assessment examines what negative effects the data processing could have on the affected individuals."]
[{"$f":"IF(ISBLANK($B23),\"\",MAX($A$7:A22)+1)","v":16},"Data protection audits","We regularly conduct data protection audits, which also include the project or the relevant processing of personal data. This way, deficiencies can be more efficiently detected and eliminated.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B23)>0,\"X\",\" \")","v":" "},"Compliance with data protection should not only be checked at the beginning of a project, but repeatedly, as changes may occur or measures may no longer be appropriate. These audits are best carried out by individuals who are not involved in the data processing themselves."]
[{"$f":"IF(ISBLANK($B24),\"\",MAX($A$7:A23)+1)","v":17},"ISMS","We have an Information Security Management System (ISMS). This ensures that information security, especially in relation to the project and the personal data processed with it, is regularly reviewed and improved as needed.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B24)>0,\"X\",\" \")","v":"X"},"This is a measure that usually takes place independently of a specific data processing, but is part of the information security activities of a company. These are a series of processes and documentation, with which the company's information security is continuously recorded, assessed and improved."]
[{"$f":"IF(ISBLANK($B25),\"\",MAX($A$7:A24)+1)","v":18},"Reporting of data breaches","We have ensured that a breach of data security related to the project or the personal data processed here is immediately reported to the right place, so that they can take the necessary steps.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B25)>0,\"X\",\" \")","v":" "},"The law provides for a mandatory reporting requirement for certain data security breaches (so-called data breaches). The report has to be made to the supervisory authority (with the law defining the thresholds of risk). Under certain circumstances, the affected individuals must also be informed. It should be clarified here which data breaches could occur in the project and how they would be discovered."]
[{"$f":"IF(ISBLANK($B26),\"\",MAX($A$7:A25)+1)","v":19},"Data processing agreement","We have concluded a contract with the data processors we use in accordance with legal requirements.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B26)>0,\"X\",\" \")","v":" "},"Such a contract is required by law when one's own data processing is delegated to a third party. This so-called processor must then be obliged by means of a contract, according to certain specifications, to ensure that it only does what the person responsible for the processing (i.e. the controller) is allowed and wants to do. Under the GDPR, the contents of the contract are regulated in detail (Art. 28)."]
[{"$f":"IF(ISBLANK($B27),\"\",MAX($A$7:A26)+1)","v":20},"Safeguards for export to third countries without adequate data protection","As far as personal data is disclosed to recipients in \"insecure\" third countries (also via remote access), i.e. countries without an adequate level of data protection, we have taken the legally required protective measures, unless we can rely on an exception.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B27)>0,\"X\",\" \")","v":" "},"The transfer of personal data to countries without adequate data protection is subject to additional restrictions. Either there needs to be a special justification for this, or protection must be ensured in another way (e.g. by way of a contract)."]
[{"$f":"IF(ISBLANK($B28),\"\",MAX($A$7:A27)+1)","v":21},"Defined retention periods","We have determined how long we need to keep the various categories of personal data relevant here.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B28)>0,\"X\",\" \")","v":" "},"By law, personal data may only be retained as long as necessary. Therefore, it may make sense to define retention periods to implement this requirement."]
[{"$f":"IF(ISBLANK($B29),\"\",MAX($A$7:A28)+1)","v":22},"Deletion concept","We have a concept that regulates when and how the data we have processed should be deleted.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B29)>0,\"X\",\" \")","v":" "},"According to law, personal data may only be stored as long as necessary. Therefore, it may make sense to define a deletion concept to implement this requirement."]
[{"$f":"IF(ISBLANK($B30),\"\",MAX($A$7:A29)+1)","v":23},"Awareness measures","We regularly carry out measures to create awareness and remind employees about the correct behavior and the risks concerning data processing.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B30)>0,\"X\",\" \")","v":" "},"These measures can, for example, be refresher trainings, cheat sheets, covert testing of employees, advertising campaigns, circulars."]
[{"$f":"IF(ISBLANK($B31),\"\",MAX($A$7:A30)+1)","v":24},"Data updating process","With specific processes, the processed personal data is kept up to date, such as regular checks for errors/deviations or the provision of self-service functionalities, with which affected persons can correct their data independently if necessary.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B31)>0,\"X\",\" \")","v":" "},"The solution does not allow the affected persons to themselves keep their data updated (e.g. via web or app), but the system could be programmed, for example, to regularly present users with data for review, or the employees are instructed to check the data, for example, every quarter."]
[{"$f":"IF(ISBLANK($B32),\"\",MAX($A$7:A31)+1)","v":25},"Responsibilities documented","We define and document the responsibilities, decision-making competencies, and escalation paths concerning data processing, e.g. in the form of process descriptions or RACIs.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B32)>0,\"X\",\" \")","v":" "},"In order to comply with data protection requirements, everyone must be clear about who is responsible for what and what tasks and competencies they have. This can be regulated in a directive or in a guideline."]
[{"$f":"IF(ISBLANK($B33),\"\",MAX($A$7:A32)+1)","v":26},"Records of processing activities","We enter the data in our Records of Processing Activities (ROPA) and ensure that it is updated upon changes.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B33)>0,\"X\",\" \")","v":"X"},"The law requires that such a directory of all processing activities is maintained by at least companies with 250 employees or more (for smaller ones, it depends on the type of data processing). "]
[{"$f":"IF(ISBLANK($B34),\"\",MAX($A$7:A33)+1)","v":27},"Possibility to opt-out","We offer the affected individuals the option to entirely or partially stop the processing of their data through an \"opt-out\". We store these settings with their other data.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B34)>0,\"X\",\" \")","v":" "},"This is a way to prevent unwanted negative consequences for affected individuals, because those who do not want their data to be processed can declare an opt-out. Then their data will no longer be processed or not processed comprehensively. The possibility of opting out should be pointed out to them."]
[{"$f":"IF(ISBLANK($B35),\"\",MAX($A$7:A34)+1)","v":28},"Consent","We process the data of the affected persons only with their consent.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B35)>0,\"X\",\" \")","v":" "},"This is a way to prevent unwanted negative consequences for affected individuals, because only those who want to be are included. However, a valid consent requires adequate information and must be given voluntarily."]
[{"$f":"IF(ISBLANK($B36),\"\",MAX($A$7:A35)+1)","v":29},"Internal consent management","We use features that allow us to systematically record, trace, and manage the consents given by the affected individuals.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B36)>0,\"X\",\" \")","v":" "},"The point here is that where we base the processing on consent, we manage these consents automatically in the solution or in another system."]
[{"$f":"IF(ISBLANK($B37),\"\",MAX($A$7:A36)+1)","v":30},"External consent management","We use functions that allow the affected individuals to manage their consents given to us via an online interface.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B37)>0,\"X\",\" \")","v":" "},"With such a function, the affected individuals can manage their consents themselves via the web or an app, i.e. grant and withdraw them (like for instance with cookies on a website)."]
[{"$f":"IF(ISBLANK($B38),\"\",MAX($A$7:A37)+1)","v":31},"Periodic review of logs","We periodically evaluate audit logs to detect irregularities. This helps us to increase data security and identify breaches of data protection.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B38)>0,\"X\",\" \")","v":" "},"Log files (i.e., records or audit trails in the systems used) should not only be evaluated after an incident, but periodically, to detect any irregularities early on."]
[{"$f":"IF(ISBLANK($B39),\"\",MAX($A$7:A38)+1)","v":32},"Real-time review of logs","We evaluate audit trails in real time to detect irregularities. This helps us to increase data security and to identify breaches of data protection.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B39)>0,\"X\",\" \")","v":" "},"Ideally, log files are fully automated and evaluated in real time, i.e. scanned for unusual patterns. If such are detected, the systems trigger an alarm. This way, data security breaches can be detected and combated much earlier."]
[{"$f":"IF(ISBLANK($B40),\"\",MAX($A$7:A39)+1)","v":33},"Right of access ensured","We have ensured that we can fulfill an access request from a data subject with regard to the personal data processed for the project  (insofar we must and may comply with it).",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B40)>0,\"X\",\" \")","v":" "},"The law gives affected persons the right to request a copy of their personal data that is being processed. This means that it must be possible to find and retrieve this data (and some other information) so that information can be provided if needed."]
[{"$f":"IF(ISBLANK($B41),\"\",MAX($A$7:A40)+1)","v":34},"Right to delete ensured","We have ensured that the personal data processed for the project can also be deleted or anonymized as far as legally required.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B41)>0,\"X\",\" \")","v":"X"},"The law stipulates that personal data should only be processed (including stored) for as long as necessary. In addition, affected individuals may under certain circumstances demand immediate deletion. Therefore, such a deletion must be ensured."]
[{"$f":"IF(ISBLANK($B42),\"\",MAX($A$7:A41)+1)","v":35},"Correction possibility ensured","We have ensured that the personal data processed in the project can also be corrected as far as legally required, should they prove to be incorrect or incomplete in relation to their purpose of use.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B42)>0,\"X\",\" \")","v":" "},"The law gives affected individuals the right to have the data which is being processed about them corrected if necessary. This means that it must be possible to adjust their data as needed and possibly also to make a note that the data is disputed. If this is not possible, data may have to be deleted under certain circumstances."]
[{"$f":"IF(ISBLANK($B43),\"\",MAX($A$7:A42)+1)","v":36},"Tests of the project","We have practically tested the project/the solution or are still doing so in order to detect unwanted effects early and mitigate them.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B43)>0,\"X\",\" \")","v":" "},"To avoid unwanted negative consequences, it can be advantageous to test the proposed solution in practice with affected individuals or in other ways beforehand to see where it may still have weaknesses or risks."]
[{"$f":"IF(ISBLANK($B44),\"\",MAX($A$7:A43)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B44)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B45),\"\",MAX($A$7:A44)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B45)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B46),\"\",MAX($A$7:A45)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B46)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B47),\"\",MAX($A$7:A46)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B47)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B48),\"\",MAX($A$7:A47)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B48)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B49),\"\",MAX($A$7:A48)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B49)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B50),\"\",MAX($A$7:A49)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B50)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B51),\"\",MAX($A$7:A50)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B51)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B52),\"\",MAX($A$7:A51)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B52)>0,\"X\",\" \")","v":" "}]
[{"$f":"COUNTIF(A8:A52,\">0\")","v":36},{"$f":"ROW(A8)","v":8}]
[null,{"$f":"\"'DPIA Measure Catalog'!B\"&$B53-1&\":B\"&$B53+$A53-1","v":"'DPIA Measure Catalog'!B7:B43"},{"$f":"\"'DPIA Measure Catalog'!B\"&$B53-1&\":C\"&$B53+$A53-1","v":"'DPIA Measure Catalog'!B7:C43"}]
[]
["Nr.","Technical measures","Description and effect","Mandatory as per protection level",null,null,"Selected","When to use and examples"]
[0,"(wählen)",{"$f":"\" \"","v":" "},1,2,3]
[{"$f":"IF(ISBLANK($B58),\"\",MAX($A$57:A57)+1)","v":1},"Online access control","Only authorized individuals can access the non-public personal data of the project. This is to prevent any abusive or otherwise uncontrolled use.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B58)>0,\"X\",\" \")","v":"X"},"This can be implemented, for example, by allowing only people with login credentials (i.e. password protection) to access personal data. The access protection should be personal (no shared accounts). The law prescribes access control, but not the specific granularity (i.e. who can access what)."]
[{"$f":"IF(ISBLANK($B59),\"\",MAX($A$57:A58)+1)","v":2},"Physical access control","Only authorized persons have physical access to the premises and facilities where personal data is processed. This prevents abusive or otherwise uncontrolled use.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B59)>0,\"X\",\" \")","v":"X"},"This is about, for example, locking up rooms with servers or computers used for data processing and locking away files and data carriers. The law prescribes this kind of physical access control."]
[{"$f":"IF(ISBLANK($B60),\"\",MAX($A$57:A59)+1)","v":3},"User authentication","We authenticate all users who want to access our systems. This helps us prevent abusive or otherwise uncontrolled use. This also serves for logging.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B60)>0,\"X\",\" \")","v":"X"},"This is related to access control. It is about ensuring that only those individuals who have been identified as authorized persons can access personal data. This can be done, for example, through personal usernames and passwords."]
[{"$f":"IF(ISBLANK($B61),\"\",MAX($A$57:A60)+1)","v":4},"MFA for external access","All users who want to externally access the systems with which the relevant personal data is processed have to authenticate themselves using multi-factor authentication.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B61)>0,\"X\",\" \")","v":"X"},"Multi-factor authentication prevents access by unauthorized third parties with stolen access credentials and has now become an important measure, especially where a system can be accessed from the internet."]
[{"$f":"IF(ISBLANK($B62),\"\",MAX($A$57:A61)+1)","v":5},"MFA for privileged accesses","All users who have elevated privileges with regard to the systems that process the personal data relevant must authenticate themselves using multi-factor authentication.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B62)>0,\"X\",\" \")","v":"X"},"Multi-factor authentication prevents access by unauthorized third parties with stolen access codes and has now become an important measure, especially where a user has elevated access rights (e.g. administrators)."]
[{"$f":"IF(ISBLANK($B63),\"\",MAX($A$57:A62)+1)","v":6},"Time-limited privileged access (TPAM)","All users who have elevated privileges with regard to the systems that process the personal data relevant here, are each assigned their access rights only as needed and only temporarily on a case-by-case basis.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B63)>0,\"X\",\" \")","v":" "},"TPAM is an effective measure to prevent the misuse of privileged access rights."]
[{"$f":"IF(ISBLANK($B64),\"\",MAX($A$57:A63)+1)","v":7},"Encryption \"mobile\"","We encrypt mobile data carriers (including mobile computers) that contain personal data, so that an unauthorized person cannot do anything with it.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B64)>0,\"X\",\" \")","v":"X"},"What is meant is the encryption of all systems and data carriers that leave the house with confidential data, e.g. USB sticks, mobile hard drives, and notebooks. If they are stolen, third parties cannot access the data in plain text."]
[{"$f":"IF(ISBLANK($B65),\"\",MAX($A$57:A64)+1)","v":8},"Encryption \"at rest\"","We encrypt personal data when it is stored on the systems (i.e., in a resting state). Anyone who gains access to the systems cannot do anything with the data unless they have the keys.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B65)>0,\"X\",\" \")","v":"X"},"What is meant is the encryption of \"dormant\" data, i.e., the data that is stored on servers and other systems. This protects against the theft of the systems on the one hand, but can also - in combination with controlling access to the decryption keys - counteract unauthorized use of the data."]
[{"$f":"IF(ISBLANK($B66),\"\",MAX($A$57:A65)+1)","v":9},"Encryption \"in transit\"","All transfers of personal data are encrypted by us. Thus, it cannot be intercepted during transmission.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B66)>0,\"X\",\" \")","v":"X"},"What is meant is the encryption of data during its transmission over the internet or other lines that could be accessible to third parties. This is standard today, even with regard to traffic between email servers (so-called TLS). However, what is not standard is the additional encryption of emails, except in certain situations and industries (e.g. health data)."]
[{"$f":"IF(ISBLANK($B67),\"\",MAX($A$57:A66)+1)","v":10},"Encryption keys under our full control","We can generally have sole control over who can use the keys in the system being used (e.g. which users can use them to decrypt the personal data). This way, we prevent access by unauthorized persons.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B67)>0,\"X\",\" \")","v":" "},"This is about the question of who actually controls the keys used for encryption and access to them. This can be the provider or the customer in the cloud, for example. This measure refers to the case where the keys remain under the control of the customer, at least in principle."]
[{"$f":"IF(ISBLANK($B68),\"\",MAX($A$57:A67)+1)","v":11},"Backups","We regularly backup all personal data and periodically check it.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B68)>0,\"X\",\" \")","v":"X"},"The legal requirement for data backup of personal data is essentially prescribed where the loss of data can cause disadvantages for the affected individuals. It can be done online (e.g., cloud) or on data carriers. This is to be distinguished from the redundant design of systems. This is not yet considered a backup."]
[{"$f":"IF(ISBLANK($B69),\"\",MAX($A$57:A68)+1)","v":12},"Backups (off-site storage)","We store the backups at a different location so that they are not lost even in the event of a disaster.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B69)>0,\"X\",\" \")","v":" "},"This ensures that backups are still available even if the location of the systems is destroyed by a fire, for example. Not all backups need to be stored externally."]
[{"$f":"IF(ISBLANK($B70),\"\",MAX($A$57:A69)+1)","v":13},"Backups (air-gapped)","The backups are physically separated from our system, so that unauthorized persons cannot access them and destroy them on our system.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B70)>0,\"X\",\" \")","v":" "},"The reasoning behind this measure is the fact that third parties who maliciously attack and sabotage a system often also try to destroy backups. If these are not connected to the systems into which the third parties have intruded, they can no longer do this. This can be achieved by temporarily establishing the connection for backups or by performing backups on external data carriers."]
[{"$f":"IF(ISBLANK($B71),\"\",MAX($A$57:A70)+1)","v":14},"Malware protection","We use a solution for the detection and elimination of malware that also protects the relevant personal data or the systems on which this is processed.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B71)>0,\"X\",\" \")","v":" "},"It is standard today that software is used to prevent the infiltration of malware or to detect it on systems (e.g., virus scanners, email filters, software for scanning visited websites)."]
[{"$f":"IF(ISBLANK($B72),\"\",MAX($A$57:A71)+1)","v":15},"Logging (Basic)","We record when and by whom personal data is entered, changed or disclosed (audit trails). This ensures the traceability of the processing of personal data in the solution.","X","X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B72)>0,\"X\",\" \")","v":"X"},"This simple form of audit trails is required by law in Switzerland. Therefore, it should always be used when personal data is processed."]
[{"$f":"IF(ISBLANK($B73),\"\",MAX($A$57:A72)+1)","v":16},"Logging (extended)","We record the saving, modifying, reading, disclosing, deleting, and destroying of personal data in systems used here. We keep the audit trails for at least one year and separated from the system at issue. This allows us to detect and go after data protection violations at least retrospectively and make improvements. It also has a preventive effect.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B73)>0,\"X\",\" \")","v":" "},"This extended form of audit trails is prescribed by law in Switzerland, especially when particularly sensitive personal data is processed on a large scale or high risk profiling is carried out and data protection cannot be guaranteed in any other way than by logging."]
[{"$f":"IF(ISBLANK($B74),\"\",MAX($A$57:A73)+1)","v":17},"Penetration tests","We periodically conduct security tests of our systems that process the relevant personal data here. In doing so, experts try to penetrate them and thus reveal vulnerabilities.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B74)>0,\"X\",\" \")","v":" "},"The point here is to have your own systems checked for security by external third parties by having these third parties try to penetrate the systems on your behalf. They scan the system for known vulnerabilities, for example."]
[{"$f":"IF(ISBLANK($B75),\"\",MAX($A$57:A74)+1)","v":18},"Pseudonymization","We use functions and data elements that provide for data processing in pseudonymized form (e.g. by using ID numbers instead of clear names or by masking data).",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B75)>0,\"X\",\" \")","v":" "},"The law requires that access to personal data is limited to those who really need it. This can be done not only by restricting access rights, but also by pseudonymization, i.e., the data is coded in such a way that users can still see it, but without knowledge of a code, they do not know who it pertains to."]
[{"$f":"IF(ISBLANK($B76),\"\",MAX($A$57:A75)+1)","v":19},"Differential privacy","We add \"noise\" to the data before using it for non-personal purposes to prevent the re-identification of the affected individuals based on the result as much as possible.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B76)>0,\"X\",\" \")","v":" "},"This refers to a measure in which data records, which are used as a basis for non-personal processing (such as training an AI or creating statistics), are altered to an extent that re-identification of the affected persons is ideally no longer possible, but the meaningfulness of the processing is maintained as much as possible."]
[{"$f":"IF(ISBLANK($B77),\"\",MAX($A$57:A76)+1)","v":20},"Anonymization","Data is anonymized using appropriate techniques (aggregation, generalization, masking, etc.) before processing, so that re-identification of the affected individuals is no longer reasonably possible.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B77)>0,\"X\",\" \")","v":" "},"If there is no more personal data available, then data protection no longer needs to be considered for these \"de-identified\" data. In principle, personal data should be anonymized (or deleted) as soon as they are no longer needed. However, anonymization can also make it possible to use data for purposes for which they could not otherwise be used according to data protection."]
[{"$f":"IF(ISBLANK($B78),\"\",MAX($A$57:A77)+1)","v":21},"Restriction of transfers","The system is set up so that the data on processed individuals cannot be exported or copied, or transmitted to further locations.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B78)>0,\"X\",\" \")","v":" "},"Every responsible person must ensure that the data they process is not misused and is not processed by unauthorized persons. Therefore, it may be useful to limit the possibilities that personal data can be extracted from a system or solution (e.g., through an export function or the possibility of using broad queries)."]
[{"$f":"IF(ISBLANK($B79),\"\",MAX($A$57:A78)+1)","v":22},"Data deletion mechanisms","We have ensured with appropriate functions that we generally delete or anonymize personal data that we no longer need.",null,"X","X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B79)>0,\"X\",\" \")","v":"X"},"Personal data may, according to law, only be stored as long as it is really still needed. Afterwards, it should be deleted or automated. This can be supported by corresponding functions in a system or a solution (e.g., automatic solution or template for deletion)."]
[{"$f":"IF(ISBLANK($B80),\"\",MAX($A$57:A79)+1)","v":23},"No unnecessary data elements","We have limited the data elements that are provided to those that are absolutely necessary for processing; we have foregone the \"nice-to-have\" ones.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B80)>0,\"X\",\" \")","v":" "},"The principle of data minimization requires that only the personal data that is really needed be collected. This measure is about checking whether the solution or the project has been checked to see if only the necessary data have been collected."]
[{"$f":"IF(ISBLANK($B81),\"\",MAX($A$57:A80)+1)","v":24},"No free text fields","We do not use free text fields.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B81)>0,\"X\",\" \")","v":" "},"Free text fields can be dangerous for data protection because users can capture any data in them, specifically those that they should not capture because they violate data protection or cannot be systematically captured. Therefore, if possible, refrain from using free text fields."]
[{"$f":"IF(ISBLANK($B82),\"\",MAX($A$57:A81)+1)","v":25},"Workaround in case of outages","In the event of a prolonged failure of the systems for the relevant data processing here, we have a workaround solution so that we can continue the most important affected business processes.",null,null,"X",{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B82)>0,\"X\",\" \")","v":" "},"Every system and solution can fail for an extended period of time. Where an operation depends on function or availability, it should therefore have a plan for contingencies, e.g. a backup system, a workaround solution, or a plan for manual data processing."]
[{"$f":"IF(ISBLANK($B83),\"\",MAX($A$57:A82)+1)","v":26},"Patch management","We have a process that ensures that the systems used for processing personal data are always kept up to date with the latest security standards and known critical gaps are closed as quickly as possible.",null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B83)>0,\"X\",\" \")","v":" "},"Every software usually contains errors. Depending on the situation, these can also be used for attacks on the systems or solutions that are operated with this software. Therefore, it is important to install patches and other updates that the manufacturer of a software publishes quickly after their appearance to protect the system from known vulnerabilities."]
[{"$f":"IF(ISBLANK($B84),\"\",MAX($A$57:A83)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B84)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B85),\"\",MAX($A$57:A84)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B85)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B86),\"\",MAX($A$57:A85)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B86)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B87),\"\",MAX($A$57:A86)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B87)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B88),\"\",MAX($A$57:A87)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B88)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B89),\"\",MAX($A$57:A88)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B89)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B90),\"\",MAX($A$57:A89)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B90)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B91),\"\",MAX($A$57:A90)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B91)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B92),\"\",MAX($A$57:A91)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B92)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B93),\"\",MAX($A$57:A92)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B93)>0,\"X\",\" \")","v":" "}]
[{"$f":"IF(ISBLANK($B94),\"\",MAX($A$57:A93)+1)","v":""},null,null,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$89:$B$117,$B94)>0,\"X\",\" \")","v":" "}]
[{"$f":"COUNTIF(A58:A94,\">0\")","v":26},{"$f":"ROW(A58)","v":58}]
[null,{"$f":"\"'DPIA Measure Catalog'!B\"&$B95-1&\":B\"&$B95+$A95-1","v":"'DPIA Measure Catalog'!B57:B83"},{"$f":"\"'DPIA Measure Catalog'!B\"&$B95-1&\":C\"&$B95+$A95-1","v":"'DPIA Measure Catalog'!B57:C83"}]
["Measure generator (only available in the AI version)"]
[]
[null,"Undesired negative consequence, for which possible countermeasures are being sought:","The affected individuals are afraid that voice identification will be misused."]
[]
[]
[null,"Ideas for countermeasures:","1. Transparency: Clearly inform callers about the purpose and use of voice identification, including how their data will be stored and protected.\r\n2. Consent: Obtain explicit consent from callers before recording and storing their voiceprints.\r\n3. Data Minimization: Only collect and store the minimum amount of data necessary for voice identification.\r\n4. Security Measures: Implement robust security measures such as encryption and access controls to protect voiceprints from unauthorized access.\r\n5. Regular Audits: Conduct regular audits to ensure compliance with data protection laws and to verify that voiceprints are being used appropriately."]
[]
["Author & Developer: David Rosenthal (drosenthal@vischer.com, VISCHER Legal Innovation Lab). All rights reserved. A project of the Corporate Data Protection Association (VUD)."]
[]
[]
["Attention: The Excel worksheets are protected by a sheet protection. However, this can be lifted without a password."]

{"sheet":"DPIA Risk Catalog","index":2,"n_rows":84,"n_cols":6,"rows_kept":84,"cut":false,"hidden":false,"merged":[[0,0,0,1],[1,0,1,1],[81,0,81,3]]}
[{"$f":"'DPIA Main'!$A$1","v":"Data Protection Impact Assessment (DPIA)"},null,{"$f":"_xlfn.CONCAT($B$69:$B$78)","v":"Unauthorized access: A hacker breaches the database, steals voice prints, and impersonates numerous individuals, leading to identity theft.Data breach: Sensitive voice recordings and personal IDs are leaked online, causing significant privacy invasion and social distress.Misidentification: The AI incorrectly matches a voice print, resulting in a legitimate caller's access being denied and causing frustration and service disruption.Profiling: The voice data is misused to create detailed profiles of individuals, increasing the risk of targeted scams or harassment.System failure: The cloud-based system experiences downtime, preventing callers from being verified and disrupting call center operations.Data misuse: An employee at StarVoice Inc. abuses access to personal data to commit fraud or blackmail.Legal repercussions: Unauthorized data transfer to entities outside the agreed locations leads to legal penalties and affects data subjects’ trust.Inadequate anonymization: Voice prints stored in a non-anonymized form are correlated with other personal data, compromising personal privacy.Re-identification: Advanced algorithms re-identify anonymized voice prints with high accuracy, leading to unforeseen privacy violations.Inaccurate updates: Periodic updates to voice prints fail, causing outdated data to be used and leading to frequent and unjustified access denials for callers."},{"$f":"ROW($B$69)","v":69}]
[{"$f":"'DPIA Main'!$A$2","v":"Version 22.9.2024 - Private Sector CH-FADP/GDPR"},null,{"$f":"ROW($B$10)","v":10},{"$f":"ROW($B$78)","v":78}]
[]
["Catalogue of possible unintended negative consequences for affected individuals",null,null,"Back to the main sheet"]
[]
["General Risks"]
[]
["No.","Possible unintended  negative consequences (despite the measures)","What we can do about it","How the residual risk is generally assessed",null,"Übernehmen"]
[]
[{"$f":"A9+1","v":1},"Personal data used in the project is leaked due to an error or intentionally to unauthorized third parties. They misuse it to the detriment of the affected individuals.",null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B10)>0,\"X\",\" \")","v":" "},"Yes"]
[2,"Personal data used in the project is leaked due to an error or intentionally to an unauthorized internal person. This person misuses it to the detriment of the affected individuals.",null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B11)>0,\"X\",\" \")","v":" "},"Yes"]
[3,"Personal data used in the project is accidentally deleted in whole or in part. This leads to a disadvantage for the affected individuals.",null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B12)>0,\"X\",\" \")","v":" "},"Yes"]
[4,"Personal data used in the project is partially or completely deleted by an attacker. This leads to a disadvantage for the affected individuals.",null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B13)>0,\"X\",\" \")","v":" "},"Yes"]
[5,"The solution or the systems with which we process the personal data used in the project no longer allows us to access or otherwise process the data. This leads to a disadvantage for the affected individuals.",null,null,null,"Yes"]
[6,"Personal data used in the project is manipulated by an external attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.",null,null,null,"Yes"]
[7,"Personal data used in the project is manipulated by an internal attacker, which we do not immediately notice and which in turn leads to a disadvantage for the affected individuals.",null,null,null,"Yes"]
[8,"Personal data used in the project is not updated due to an error in the solution, system, or operation, partially deleted or otherwise falsified, which we do not notice immediately and which in turn leads to a disadvantage for the affected persons.",null,null,null,"Yes"]
[9,"The affected individuals do not realize that we are collecting their personal data or what we are doing with it. This lack of transparency leads to distrust and discomfort among these individuals and other disadvantages for them.",null,null,null,"Yes"]
[10,"Personal data used in the project is misused by us compared to our original communication, which leads to distrust and discomfort by the affected persons and other disadvantages for them.",null,null,null,"Yes"]
[11,"Personal data used in the project is used contrary to applicable rules by a third party for purposes other than intended, which leads to distrust and discomfort by the affected persons and other disadvantages for them.",null,null,null,"Yes"]
[12,"We are unable to satisfy an affected individual's access right, i.e. the information about their relevant personal data and the other aspects of data processing that they may ask us about or request. As a result, they cannot properly enforce their legal rights to ensure their data protection.",null,null,null,"Yes"]
[13,"We are unable to delete the data of an affected individual at its request, even though we should do so. This leads to discomfort among the affected individuals and other disadvantages for them.",null,null,null,"Yes"]
[14,"We are unable to correct the data of an affected individual at ist request, even though we should do this. This leads to discomfort of the affected individuals and other disadvantages for them, because we process incorrect or incomplete data about them.",null,null,null,"Yes"]
[15,"We are unable to delete the personal data no longer needed. This leads to such data being misused to the detriment of the affected individuals or they can fall into the hands of unauthorized persons, with all the consequences of such an incident.",null,null,null,"Yes"]
[16,"Our data processing has errors or gaps. This leads to affected individuals suffering financial losses or disadvantages.",null,null,null,"Yes"]
[17,"Our data processing has errors or gaps. This leads to services being denied to affected individuals in an unintended manner.",null,null,null,"Yes"]
[18]
[19,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B28)>0,\"X\",\" \")","v":" "}]
[20,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B29)>0,\"X\",\" \")","v":" "}]
[21,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B30)>0,\"X\",\" \")","v":" "}]
[22,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B31)>0,\"X\",\" \")","v":" "}]
[23,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B32)>0,\"X\",\" \")","v":" "}]
[24,null,null,null,{"$f":"IF(COUNTIF('DPIA Main'!$B$46:$B$83,$B33)>0,\"X\",\" \")","v":" "}]
[]
["Specific risks in the XYZ area"]
[]
["No.","Possible unintended  negative consequences (despite the measures)","What we can do about it","How the residual risk is generally assessed"]
[]
[{"$f":"A38+1","v":1}]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
[10]
[]
["Specific risks in the XYZ area"]
[]
["No.","Possible unintended  negative consequences (despite the measures)","What we can do about it","How the residual risk is generally assessed"]
[]
[{"$f":"A53+1","v":1}]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
[9]
[10]
[]
["Spezifische Risiken für das konkrete Vorhaben (wie im Hauptblatt beschrieben)"]
[]
["No.","Possible unintended  negative consequences (despite the measures)","What we can do about it","How the residual risk is generally assessed"]
[]
[{"$f":"A68+1","v":1},"Unauthorized access: A hacker breaches the database, steals voice prints, and impersonates numerous individuals, leading to identity theft.","","",null,"Yes"]
[2,"Data breach: Sensitive voice recordings and personal IDs are leaked online, causing significant privacy invasion and social distress.","",""]
[3,"Misidentification: The AI incorrectly matches a voice print, resulting in a legitimate caller's access being denied and causing frustration and service disruption.","",""]
[4,"Profiling: The voice data is misused to create detailed profiles of individuals, increasing the risk of targeted scams or harassment.","",""]
[5,"System failure: The cloud-based system experiences downtime, preventing callers from being verified and disrupting call center operations.","",""]
[6,"Data misuse: An employee at StarVoice Inc. abuses access to personal data to commit fraud or blackmail.","",""]
[7,"Legal repercussions: Unauthorized data transfer to entities outside the agreed locations leads to legal penalties and affects data subjects’ trust.","",""]
[8,"Inadequate anonymization: Voice prints stored in a non-anonymized form are correlated with other personal data, compromising personal privacy.","",""]
[9,"Re-identification: Advanced algorithms re-identify anonymized voice prints with high accuracy, leading to unforeseen privacy violations.","",""]
[10,"Inaccurate updates: Periodic updates to voice prints fail, causing outdated data to be used and leading to frequent and unjustified access denials for callers.","",""]
[]
[null,"* Select the desired cell before clicking."]
[]
["Author & Developer: David Rosenthal (drosenthal@vischer.com, VISCHER Legal Innovation Lab). All rights reserved. A project of the Association for Corporate Data Protection (VUD)."]
[]
["Attention: The Excel worksheets are protected by a sheet protection. However, this can be lifted without a password."]

{"sheet":"FAQ","index":3,"n_rows":58,"n_cols":2,"rows_kept":58,"cut":false,"hidden":false,"merged":[[0,0,0,2]]}
[{"$f":"'DPIA Main'!$A$1 & \" - FAQ\"","v":"Data Protection Impact Assessment (DPIA) - FAQ"}]
[{"$f":"'DPIA Main'!$A$2","v":"Version 22.9.2024 - Private Sector CH-FADP/GDPR"}]
[]
["1.","Do I have to carry out a data protection impact assessment for every project?"]
[]
[null,"Not by law. Data protection law only requires this for projects that are likely to pose a high risk to the affected individuals, e.g. because the data processing has certain sensitive aspects. These may be under control in the specific case because appropriate measures are being taken. However, the purpose of the DPIA is to check and ensure this. Therefore, there are companies that require a DPIA for every project - to be on the safe side. If you are not sure, ask your data protection officer or simply do a DPIA."]
[]
["2.","When I click on the buttons nothing happens."]
[]
[null,"There could be several reasons for this. First, make sure you have the file with the \".xlsm\" extension. Only this contains the necessary VBA macros to perform functions. Second, check if you can execute macros at all. Especially in companies, the execution of macros is often blocked because macros can be a security risk. Therefore, talk to your IT department. The macros in the DPIA have been digitally signed (by VISCHER AG). You can retrieve the corresponding certificate at www.rosenthal.ch to have the Excel file with its macros admitted. If you are asked when opening Excel whether the contents should be activated, confirm this. Otherwise, Excel blocks the execution of macros. Finally, for the AI functions, make sure that you have entered the API key from OpenAI or another suitable AI provider on the \"Config\" worksheet. This is needed for the use of the AI function. Finally, it is also possible that nothing happens when you press the button because the AI is not working properly and therefore does not respond to the request. In these cases, a so-called time-out error occurs after a certain time. In this case, you may want to choose a different model and try again later. If you do not want to use OpenAI, you can reconfigure the interface to work with models of other providers on the worksheet \"Config\"."]
[]
["3.","In other DSFA templates, a distinction is made between gross and net risk - not here. Why?"]
[]
[null,"We have considered this and decided against it for reasons of practicality and efficiency. The distinction is usually artificial, it raises additional questions, and it takes more time without visible benefit. It is often also not clear what the risk \"before\" (gross) and \"after\" (net) is. Some distinguish, for example, between the risk before conducting the DPIA and the residual risk afterwards, after all measures have been defined. In this DPIA, we only record the residual risks, as these are the only ones that matter, i.e., how the risk situation presents itself from the perspective of the affected persons after conducting the DPIA and defining all measures. As a rule, a DPIA is carried out at a time when a number of technical and organizational measures to limit risks already exist or are planned (e.g., data security measures, training, instruction, deletion concept). If it then becomes apparent during the risk assessment that certain risks are too high or that further measures make sense, these can be immediately included in step 3 in the list of existing and planned measures and taken into account in step 4 during the risk assessment. Once all measures have been defined, no one is interested anymore in which measures were only added in the course of the DPIA because they were not considered from the beginning."]
[]
["4.","Isn't it dangerous to use AI for such a task?"]
[]
[null,"No, we don't consider that dangerous. However, first, it must be ensured that no personal data and no trade secrets are entered in steps 1-4, and second, what the AI suggests in texts must be manually checked by the person who fills out the DPIA. So, one should not blindly trust the AI's suggestions, as it does not understand what it is about but merely calculates the most likely answer to the question. We believe that the use of AI for a DPIA can even contribute to the quality increase of the DPIA, as it helps to identify risks and measures that might not occur to the people who fill it out. Here, it can even be advantageous if the AI \"hallucinates\" and sees problems that may not be realistic. They can then be manually sorted out, but they stimulate thinking - and that's exactly what a DPIA is all about."]
[]
["5.","Which AI model should I choose?"]
[]
[null,"We suggest starting with the simplest, currently \"gpt-3.5-turbo\". It is cheap and fast, but provides rather simple and superficial answers. When an account is registered with OpenAI, the person receives a credit of 5 dollars. With this simple model, many queries can be executed without having to pay. \"gpt-4\" and newer models provide better quality answers, but take more time and also cost more. Everyone should experiment with what fits best for their application. The prompts and temperature can also be adjusted."]
[]
["5.","I can't enter any further measures on the main sheet."]
[]
[null,"Step 3, which is the listing of measures, works on the principle that a selection must be made from the catalog of measures listed on the \"DPIA Measures Catalog\" worksheet. If a new measure is to be recorded, it must be done there. For this, there are empty times. Each measure needs a title and a description. Once this is entered, the new measure can be selected on the main sheet. Typically, companies (or the data protection officer) define the measures usually available for selection. In this way, each company can adapt the template to its own purposes."]
[]
["6.","How can I easily implement the measures? What is the deal with the protection level?"]
[]
[null,"We have provided the option in the template to define three levels of protection. Each company sets these themselves, for example, level 1 for essentially harmless projects, while 3 can stand for projects with high risks. It can then be specified for each protection level in the worksheet \"DSFA measures catalog\" which of the measures are at least required for this protection level; each company must decide this for itself. These minimum measures can be transferred to the list of measures on the main sheet at the push of a button when macros are activated."]
[]
["7.","Why does the form ask wehther the basic infrastructure has been evaluated separately?"]
[]
[null,"This allows certain aspects of a project to be excluded. For example, if a new project is being implemented in the cloud and it is based on a cloud infrastructure that has already been assessed in terms of the risks to the affected individuals, these do not need to be evaluated again. With this parameter, it can be indicated that the risks concerning the use of the basic IT infrastructure do not need to be assessed again."]
[]
["8.","What do the four levels of severity and the probability of an adverse outcome mean for an affected person?"]
[]
[null,"Each company must define this for itself. We have indicated at the bottom of the risk table how the four levels are each designated (e.g., \"Very low\", \"Low\"). Each company can adapt these designations for its purposes, as well as from which risk value (i.e., severity x probability of occurrence) a medium and when a high risk (e.g., from 12) exists."]
[]
["9.","Why do I indicate the number of years under the risk table?"]
[]
[null,"Every risk assessment must correctly be carried out for a specific time horizon. This will typically be 3 or 5 years. This can be specified here."]
[]
["10.","What is the purpose and use of the \"Risk Catalog\" worksheet? What are the different subdivisions for?"]
[]
[null,"The worksheet \"Risk Catalog\" is a kind of \"reservoir\" or \"storage\" for paraphrases of risks and potential countermeasures and risk assessments. Here, each company can define its \"standard risks\" that it requires to be checked. We have already listed a whole series of typical data protection risks in the basic template (as \"general risks\"). These can be copied by hand (copy & paste) or via the button on the right (after previous selection) to the main sheet so that they can be assessed there. In addition to the general risks, a company can list specific risks that it typically encounters. A bank can, for example, list additional risks associated with bank customer data. In the lower section, there is still room to experiment with case-specific risks. This is particularly relevant when using AI. It can be asked to come up with ten possible, case-specific risks based on the case description and list them there (the function can also be used directly on the main sheet). This is intended as inspiration. Individual additional risks can also be added by the AI; all you have to do is select an empty field and press the corresponding button."]
[]
["11.","My version of the template does not contain any macros. Where can I get one like that?"]
[]
[null,"The most current version in a format with and without macros is available at http://www.vud.ch/dpia and as a secondary source at https://www.rosenthal.ch (www.rosenthal/downloads/vud_dpia.xlsx and www.rosenthal/downloads/vud_dpia.xlsm). The one-pager and the tutorial video can also be accessed there."]
[]
["12.","Is this template also available in other languages?"]
[]
[null,"Yes, this template is also available in German. It can be downloaded where this template can be obtained (see question 11). In addition, the macro version of this DPIA has the ability to translate the texts in the DPIA into numerous languages using AI. For this, the button to activate the translation function in column I on line 215 must be pressed. It activates the translation function, which is then available via the context menu for the selected cells. If necessary, the sheet protection must be removed before using it."]
[]
["13.","How can I remove the worksheet protection? If I want to change something, Excel does not allow it."]
[]
[null,"The sheet protection can be removed via Excel in the corresponding menu without a password. It is only intended to prevent accidental changes."]

{"sheet":"Config","index":4,"n_rows":39,"n_cols":25,"rows_kept":39,"cut":false,"hidden":false,"merged":[[19,2,19,9],[20,2,20,9],[13,15,13,22],[17,2,17,9],[40,0,40,3],[18,2,18,9],[26,2,26,9],[26,12,26,16],[26,18,26,22],[27,2,27,3],[27,5,27,9],[27,12,27,16],[27,18,27,22],[28,2,28,9],[28,12,28,16],[28,18,28,22],[0,0,0,3],[7,2,7,9],[16,2,16,9],[10,2,10,9],[9,2,9,9],[8,2,8,9],[11,2,11,9],[12,2,12,9],[13,2,13,9],[14,2,14,9],[15,2,15,9],[28,24,28,29],[29,2,29,9],[36,13,38,19],[38,0,38,9],[30,2,30,5],[32,0,32,9],[34,0,34,9],[36,0,36,9],[36,11,36,12]]}
[{"$f":"'DPIA Main'!$A$1","v":"Data Protection Impact Assessment (DPIA)"}]
[]
["Configuration of the prompts:"]
[]
[null,"Model:","gpt-4o","(e.g. gpt-4o)"]
[null,"Temperature:",1,"(from 0-2; the higher, the more creative/random; up to 0.5 is relatively focused and deterministic)"]
[]
[null,"System:","You are a data protection expert and answer all questions briefly, specifically, and in one sentence each. You avoid repetitions and think carefully about the answer. You only suggest what is realistic. With all questions, you take into account the specific characteristics of this project.",null,null,null,null,null,null,null,null,"(a description of the project follows)"]
[null,"Ten Risks:","List ten different risk scenarios of possible damage or problems that data processing can cause for an affected person or data subject; specify the specific actual damage caused to the affected person or data subject, but do neither use the words \"risk scenario\" nor \"could\", but describe the risk as if it actually happens."]
[null,"Suggest measures:","I am specifically concerned about this risk of data processing:",null,null,null,null,null,null,null,null,"(the risk scenario on the left follows)"]
[null,null,"List the three most important, very specific measures briefly in bullet points to prevent these risk causes and thus these damages and problems."]
[null,"Suggest assessment:","I am specifically concerned about the residual risk of the following data processing:",null,null,null,null,null,null,null,null,"(the risk scenario on the left follows)"]
[null,null,"These are the countermeasures taken:",null,null,null,null,null,null,null,null,"(the measures on the left follows)"]
[null,null,"Explain in two to three sentences how the specific residual risk could exactly harm the affected person or data subject, and how likely that is. Illustrate the negative consequences for the affected person or data subject very vividly, with an example, so that one can imagine it precisely."]
[null,null,"Consider the general life experience and the specific circumstances of the case. Stick to the following assessment of the severity of the consequences for the affected person or data subject and the probability or likelihood of these consequences:",null,null,null,null,null,null,null,null,"(the existing assessment follows)"]
[null,null,"First, describe how high this the specific residual risk of negative consequences for affected persons or data subjects can reasonably be assessed based on general life experience, the countermeasures taken, and the specific circumstances of the case; indicate whether the severity of the consequences is 'minor', 'manageable', 'substantial' or 'gross' and the probability that both the scenario and these consequences will occur is 'very low', 'low', 'medium' or 'high'. Then describe the following:",null,null,null,null,null,null,null,null,"(if no assessment is available)"]
[null,"Further risk:","Describe a risk scenario of possible problems, which the data processing can cause to an affected person or data subject; state the specific damage for the affected person or data subject, but neither use the words \"risk scenario\" nor \"could\", but describe the risk as if it actually happens. This risk scenario may not contain any of the following risk scenarios:",null,null,null,null,null,null,null,null,"(a list of the previous risks follows)"]
[null,"Fill in more cells:","Answer the following question in three to four sentences, convincingly and very specifically for a data protection authority and for and taking into account the described project:",null,null,null,null,null,null,null,null,"(the question on the left, in column B, follows)"]
[null,"Measure generator:","Suggest to me five measures with which the following risk and the associated unintended negative consequences can be avoided or at least mitigated:",null,null,null,null,null,null,null,null,"(the risk or the consequences that are at stake follow)"]
[null,"Insert existing measures:","I am specifically concerned about this risk of data processing:",null,null,null,null,null,null,null,null,"(the risk scenario follows on the left)"]
[null,null,"Which five measures best reduce or eliminate the specific risk? Before each measure, make a dash and justify for each measure why chosen. Use only and exclusively measures from the following list:",null,null,null,null,null,null,null,null,"(the list of existing measures follow)"]
[]
["Technical configuation of the API interface:"]
[]
[null,"API-Key:",null,null,null,null,null,null,"Encrypted: ","No",null,null,null,null,"Encryptor/Decryptor (weakly) encrypts/decrypts API keys (without prefix). Use the same key as in the module \"BasicFunctions\". If \"Encrypted\" is \"Yes\", then the  stored API key will be automatically decrypted. "]
[null,"Timeout (Millisekunden):",50000,null,null,null,null,null,"API-Prefix: ","sk-"]
[null,"Endpoint (insert {model} and {apikey} if necessary):","https://api.openai.com/v1/chat/completions",null,null,null,null,null,null,null,null,"Azure:","https://[insert_your_endpoint_here]/openai/deployments/{deployment-id}/chat/completions?api-version=2024-06-01",null,null,null,null,"OpenAI:","https://api.openai.com/v1/chat/completions"]
[null,"Header (insert placeholder {apikey}):","Authorization",null,",","Bearer {apikey}",null,null,null,null,null,"Azure:","api-key, {apikey}",null,null,null,null,"OpenAI:","Authorization, Bearer {apikey}"]
[null,"API-Call (insert placeholder {model}, {promptsystem}, {promptuser} and {temperature}):","{\"model\": \"{model}\",  \"messages\": [{\"role\": \"system\",\"content\": \"{promptsystem}\"},{\"role\": \"user\",\"content\": \"{promptuser}\"}],\"temperature\": {temperature}}",null,null,null,null,null,null,null,null,"Azure:","{\"messages\": [{\"role\": \"system\",\"content\": \"{promptsystem}\"},{\"role\": \"user\", \"content\": \"{promptuser}\"}],\"temperature\": {temperature}}",null,null,null,null,"OpenAI:","{\"model\": \"{model}\",  \"messages\": [{\"role\": \"system\",\"content\": \"{promptsystem}\"},{\"role\": \"user\",\"content\": \"{promptuser}\"}],\"temperature\": {temperature}}",null,null,null,null,"For O1-Preview:","{\"model\": \"{model}\",  \"messages\": [{\"role\": \"user\",\"content\": \"{promptsystem} {promptuser}\"}],\"temperature\": 1.0}"]
[null,"Response (JSON segment):","content",null,null,null,null,null,null,null,null,"Azure:","content",null,null,null,null,"OpenAI:","content"]
[null,"Run-only-at-home (Domain(s)):",null,null,null,null,{"$f":"\"  Aktuelle Domäne: \"&GetDomain()","v":"  Aktuelle Domäne: WORKGROUP"},null,null,null,null,"Attention: This red cell on the left can only be modified when sheet protection is disabled"]
[]
["This tool only works on Windows systems, but not on MacOS computers. The reason is not that Excel for MacOS or MacOS itself no longer supports access to external internet addresses, which are necessary for the use of OpenAI's API."]
[]
["The Excel worksheets come with a sheet protection (but without a password). "]
[]
["Protection of the API Key: The API key must be kept secret to prevent it from being used or misused for other purposes. It can be stored in an encrypted form. The encryption is not very strong, but since no readable text is being encrypted, it will suffice for most cases (for this reason, if the API key contains a standard prefix, add it in the relevant field above; it will not be encrypted). The encryption only supports API keys with letters and numbers. The key for decryption is encoded at the very beginning of the VBA module \"BasicFunctions\" (\"codebase\"). It can be changed there. Once this is done, the VBA project can be protected with a password. After that, the API key in plain text and the function \"Encryptor\" can be used to create and save the encrypted version with the same key. VGPT will then automatically decrypt the key when needed. Even those who access the cell with the API key will not be able to make use of it. For further protection, the \"Run-only-at-home\" function can be used by entering your own domain in the above field (or multiple domains, separated by a comma). This copy of the DPIA will then only run in these domains. Of course, the \"Config\" sheet in the distributed version of the Excel should be hidden and workbook protection activated with a password. See also instruction on the right.",null,null,null,null,null,null,null,null,null,null,"Step by step to the encrypted API key:",null,"1. At the very beginning of the VBA code, assign a secret key text to the constant \"codebasis\" (by default, \"SecretValue\" is used).\n2. In the Prefix field above, enter any standard prefix of the API key (i.e., text sequence appearing in every API key); it will not be encrypted (for security reasons).\n3. Start the Encryptor function; in the first prompt, enter the secret key text (e.g., SecretValue), and in the second prompt, enter the plain text API key along with the prefix.\n4. The result is the encrypted API key. It will be in the clipboard. It should be entered in the field for the API key above.\n5. Set the choice to \"Yes\" at the top for \"Encrypted.\"\n6. The \"Config\" worksheet should be hidden for security before distributing the Excel file. Once it is hidden, workbook protection (with a password) must be activated.\n7. The VBA project should also be password-protected before distributing the Excel file."]
[]
["Author & Developer: David Rosenthal (david.rosenthal@vischer.com, VISCHER Legal Innovation Lab). All rights reserved. A project of the Association of Corporate Data Protection (VUD)."]

{"sheet":"Changelog","index":5,"n_rows":12,"n_cols":2,"rows_kept":12,"cut":false,"hidden":false,"merged":[[0,0,0,3]]}
["Changelog"]
[]
["2023-09-25","First version for public comment (German)"]
["2023-10-08","Fixing a bug in the action generator; function to display error messages if the API generates such."]
["2023-10-28","Code Signing with EV Certificate (VISCHER Ltd.)"]
["2023-11-04","Some bug fixes and improvements; Translator function"]
["2023-11-26","Translator improved; further fixes"]
["2023-12-02","DPIA available also in English, added FAQ, minor fixes"]
["2023-12-04","Fixes"]
["2023-12-09","Adding Mac support (before Excel 2016, using MacScript) - untested"]
["2023-12-17","Amending parsing of response due to API change"]
["2023-09-22","Completely renewed AI-Interface"]