{ "version": "0.1.0", "as_of": "2026-10-04", "next_review_due": "2026-11-03", "review_cadence": "Monthly. Every claim below carries the date it was checked.", "method": { "how": "Six research agents read the primary texts on 2026-10-03, one each for EU clinical-trial rules, the United States, Swiss research law, EU data protection and cyber security, the GDPR, and the Swiss data protection act. Each reported, for every requirement, the article, the source URL, a verbatim quotation where the text was reachable, who the requirement binds, and which part of it could be checked from records or code. Each ended with what it could not confirm. Several quotations were then re-read against the primary text by the editor. Before publication, four agents with no part in the drafting checked every point against its sources; they found a problem or an unsupported claim in 11 of the 25 points and a smaller imprecision in 4 more, and all 15 were corrected in this version.", "limits": "This page is a reading of published texts, not legal advice. It locates requirements; it does not say that anyone, including us, meets them. Where the law is unsettled we say so instead of choosing an answer.", "corpus": "docs/reports/regcheck_20261003/ in the open-source assessment repository — nine seat reports in Japanese and four verification reports in English, with every source URL and check date. Working-file paths and housekeeping remarks were removed from seven of them before publication." }, "checkable_legend": { "machine": "A machine can check it from records or code: a field is present, a date is in order, a value is on a list.", "partly": "A machine can check the form; whether the requirement applies, or whether what was done is enough, needs a person.", "human": "Only a person can judge it; the text gives nothing a record could be compared against." }, "force_legend": { "law": "A statute or regulation. Binding.", "guidance": "Guidance or a statement of principles from an authority. Not binding in itself; authorities and inspectors apply it.", "draft": "A draft or consultation version. Not yet adopted; its wording may change." }, "jurisdictions": [ { "id": "eu-gcp", "name": "EU clinical trials", "scope": "ICH E6(R3) as applied in the EU, the EMA guideline on computerised systems, the Clinical Trials Regulation" }, { "id": "us", "name": "United States", "scope": "FDA Part 11 and guidance, and the Department of Justice rule on bulk genomic data" }, { "id": "ch-research", "name": "Switzerland — research and signatures", "scope": "Human Research Act, Genetic Testing Act, ZertES" }, { "id": "eu-dp", "name": "EU data protection and cyber security", "scope": "GDPR, EDPB guidelines, Cyber Resilience Act" }, { "id": "ch-dp", "name": "Switzerland — data protection", "scope": "Federal Act on Data Protection (FADP / DSG) and its ordinance (DSV)" } ], "points": [ { "id": "gcp-traceability", "jurisdiction": "eu-gcp", "title": "Transformations in analysis must be traceable, and outputs tied to the programs that produced them", "body": "ICH E6(R3), in force in the EU since 2025-07-23, puts traceability of data processing on the sponsor. Section 3.16.2(c) covers transformations and derivations; 3.16.2(f) asks that outputs be traceable to the statistical software programs, dated and time-stamped, and protected against changes. FDA finalised the same principles and Annex 1 on 2025-09-09, and Switzerland applies them through its Clinical Trials Ordinance from 2025-08-15. Of everything on this page, this is the requirement that a record of output hashes plus execution conditions answers most directly.", "quote": "The sponsor should ensure the traceability of data transformations and derivations during data processing and analysis.", "articles": [ "ICH E6(R3) 3.16.2(c)", "3.16.2(f)" ], "binds": "Sponsor", "force": "guidance", "checkable": "partly", "machine_part": "Whether each output links to its inputs, the program version and the run record, with timestamps.", "human_part": "Whether that trail is sufficient for the analysis it supports.", "sources": [ "ich-e6r3-ema", "fda-e6r3-fr", "swissmedic-e6r3" ] }, { "id": "gcp-audit-trail", "jurisdiction": "eu-gcp", "title": "Every creation and change of electronic trial data needs an audit trail", "body": "The EMA guideline on computerised systems in clinical trials asks for an audit trail on the original creation and every later modification of electronic data — secure, computer-generated and time-stamped — that ordinary users cannot switch off (section 6.2.1). ICH E6(R3) adds that audit trails should not be disabled and that dates and times should be unambiguous, giving coordinated universal time as its example (4.2.2).", "quote": "An audit trail should be enabled for the original creation and subsequent modification of all electronic data.", "articles": [ "EMA/INS/GCP/112288/2023 6.2.1", "ICH E6(R3) 4.2.2" ], "binds": "Owner of the computerised system — sponsor, investigator or service provider", "force": "guidance", "checkable": "partly", "machine_part": "That the trail exists, is time-stamped in an unambiguous time zone, has no gaps, and cannot be edited or switched off by ordinary users.", "human_part": "Whether the trail is readable by a person and actually reviewed.", "sources": [ "ema-cs-guideline", "ich-e6r3-ema" ] }, { "id": "gcp-no-exclusive-control", "jurisdiction": "eu-gcp", "title": "The sponsor must never hold the only copy — and a distributed ledger is named as one way to show it", "body": "Section 6.6 of the same guideline: all data the sponsor holds should be verifiable against a copy not held by the sponsor. A system run by an independent service provider is the usual answer; instead, the sponsor may take other technical measures that preclude sole control, and the guideline gives as its example verifiability of transactions by an independent, distributed, tamper-proof ledger, which should be justified and documented. It is the only place in the European clinical-trial texts we have read that names such a ledger.", "quote": "The sponsor should not have exclusive control of the data entered in a computerised system at any point in time.", "articles": [ "EMA/INS/GCP/112288/2023 6.6" ], "binds": "Sponsor", "force": "guidance", "checkable": "partly", "machine_part": "Whether an independent copy or ledger entry exists for each record, and when it was made.", "human_part": "Whether the measure actually precludes sole control, and whether its justification holds.", "sources": [ "ema-cs-guideline" ] }, { "id": "gcp-capture-processing", "jurisdiction": "eu-gcp", "title": "Processing at the point of data capture must be possible to validate — and no method is given", "body": "Section 4.4, on source data: when processing is an integral part of capturing data and the unprocessed data are not kept, it should be possible to validate that the processing worked correctly. The guideline gives no method. The sentence concerns processing during capture, before data are recorded — not analysis pipelines in general — and we do not read it wider than that.", "quote": "It should be possible to validate the correct operation of the processing.", "articles": [ "EMA/INS/GCP/112288/2023 4.4" ], "binds": "Sponsor and system owner", "force": "guidance", "checkable": "partly", "machine_part": "Whether a validation record exists for the capture step and names the version that ran.", "human_part": "What validation is enough: the text sets no method.", "sources": [ "ema-cs-guideline" ] }, { "id": "gcp-migration", "jurisdiction": "eu-gcp", "title": "Migrated data must be verified — checksums are given as an example", "body": "When data move from an old system to a new one, validating the migration deserves no less attention than validating the system, and the guideline names checksums, case counts and quality control of records as ways to verify the migrated data (section 6.10).", "quote": "any foreseen possibilities that may exist to verify the migrated data (e.g. checksum, case counts, quality control of records)", "articles": [ "EMA/INS/GCP/112288/2023 6.10" ], "binds": "System owner", "force": "guidance", "checkable": "partly", "machine_part": "Checksums and record counts before and after the migration.", "human_part": "Quality control of the records, and whether the plan addressed the risks that mattered.", "sources": [ "ema-cs-guideline" ] }, { "id": "ctr-tmf-traceable", "jurisdiction": "eu-gcp", "title": "Changes to the trial master file must be traceable — this one is binding law", "body": "The Clinical Trials Regulation is directly applicable law. Article 58 requires the master file to be archived for at least 25 years after the end of the trial and any alteration to its content to be traceable. The EU pharmaceutical package, on which the Council adopted its first-reading position on 2026-09-28, amends this Regulation; the amendment was not in the Official Journal on 2026-10-03.", "quote": "Any alteration to the content of the clinical trial master file shall be traceable.", "articles": [ "Regulation (EU) No 536/2014 Art. 58" ], "binds": "Sponsor and investigator", "force": "law", "checkable": "partly", "machine_part": "Whether every change to the file is recorded with what changed, who changed it and when.", "human_part": "Whether the archive will still be readable in 25 years.", "sources": [ "eu-ctr", "council-pharma-package" ] }, { "id": "ai-evidence-provenance", "jurisdiction": "eu-gcp", "title": "Using AI to produce evidence: the EMA and FDA principles ask for traceable, verifiable provenance", "body": "EMA and FDA published ten guiding principles for AI in drug development in January 2026. The sixth asks that data provenance, processing steps and analytical decisions be documented in a traceable and verifiable way. It is a statement of principles, not a regulation. FDA's draft guidance on using AI to support regulatory decisions for drugs and biologics (FDA-2024-D-4689) was still a draft on 2026-10-04.", "quote": "Data source provenance, processing steps, and analytical decisions are documented in a detailed, traceable, and verifiable manner", "articles": [ "EMA-FDA guiding principles, principle 6", "FDA-2024-D-4689 (draft)" ], "binds": "Developers and users of AI that produce evidence for regulators", "force": "guidance", "checkable": "partly", "machine_part": "Whether a provenance record exists for each data source, processing step and model version.", "human_part": "Whether the analytical decisions recorded were sound.", "sources": [ "ema-fda-ai-principles", "fda-ai-drug-guidance" ] }, { "id": "part11-audit-trail", "jurisdiction": "us", "title": "Part 11 requires audit trails that never obscure what was there before", "body": "21 CFR Part 11 is binding for electronic records kept under FDA requirements. Section 11.10(e) requires secure, computer-generated, time-stamped audit trails, and record changes must not obscure previously recorded information. Since its 2003 scope-and-application guidance, which is still final and unrevised, FDA has said it will exercise enforcement discretion on the audit-trail requirements. In clinical investigations, FDA's 2024 question-and-answer guidance on electronic systems is the operative text.", "quote": "Record changes shall not obscure previously recorded information.", "articles": [ "21 CFR 11.10(e)" ], "binds": "Anyone keeping electronic records under FDA requirements", "force": "law", "checkable": "partly", "machine_part": "Whether entries are time-stamped and earlier values remain visible after a change.", "human_part": "Whether the trail is \"secure\".", "sources": [ "ecfr-part11", "fda-part11-scope", "fda-electronic-systems-qa" ] }, { "id": "part11-signature-link", "jurisdiction": "us", "title": "Electronic signatures must be bound to their records so they cannot be moved to another", "body": "Section 11.70 requires electronic and handwritten signatures executed to electronic records to be linked to those records so that they cannot be excised, copied or otherwise transferred to falsify a record by ordinary means. A signature computed over a hash of the record is one way to meet the shape of this requirement.", "quote": "cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means", "articles": [ "21 CFR 11.70" ], "binds": "Anyone keeping electronic records under FDA requirements", "force": "law", "checkable": "partly", "machine_part": "Whether each signature covers a hash of the record it signs.", "human_part": "Whether the binding holds against \"ordinary means\" in the system as actually run.", "sources": [ "ecfr-part11" ] }, { "id": "us-bulk-genomic-data", "jurisdiction": "us", "title": "Genomic data on more than 100 US persons may not go to a country of concern — and a Swiss company is reached indirectly", "body": "The Department of Justice rule (28 CFR Part 202) treats human genomic data on more than 100 US persons as bulk data, and prohibits US persons from providing it to countries of concern. Switzerland is not one. The duties fall on US persons, but the prohibition on evasion (section 202.304) is not limited to them, and US customers can be expected to ask their non-US counterparties for the onward-transfer clauses of section 202.302. Separately, section 851 of Public Law 119-60, enacted on 2025-12-18 and commonly called the BIOSECURE Act, restricts federal contracts, grants and loans involving listed biotechnology companies; the Department of Defense's section 1260H list published on 2026-06-10 includes BGI Group, MGI Tech, WuXi AppTec and Novogene.", "articles": [ "28 CFR 202.205(a)", "202.302", "202.303", "202.304", "202.601", "Pub. L. 119-60 §851" ], "binds": "US persons; their non-US counterparties by contract", "force": "law", "checkable": "partly", "machine_part": "How many distinct US persons a dataset covers, and which country a recipient is in.", "human_part": "Whether a counterparty is a covered person, and whether an arrangement amounts to evasion.", "sources": [ "ecfr-part202", "doj-data-security", "biosecure-pl", "fr-dod-list" ] }, { "id": "hfg-consent-genetic", "jurisdiction": "ch-research", "title": "Reusing coded genetic data for research needs consent; coded non-genetic data does not", "body": "Under the Human Research Act, coded genetic data and samples may be reused for research only with consent (HFG Art. 32(2), with HFV Art. 29), while coded non-genetic health data may be reused if the person was informed beforehand and did not object (HFG Art. 33(2), with HFV Art. 32). For genetic data, opt-out is available only for anonymising it for research (Art. 32(3)); Article 34 allows reuse without consent only exceptionally. swissethics announced an optional template for genomic research consent on 2025-11-11 (germline only); its documents page still marked it as under review on 2026-10-03. A revision of the Act is being drafted; the revision page puts the consultation in Q2 2027, while the same office's overview page still said a draft by the end of 2026.", "articles": [ "HFG Art. 32(2)", "32(3)", "33(2)", "34", "HFV Art. 29", "HFV Art. 32" ], "binds": "Anyone reusing health data or samples for research in Switzerland", "force": "law", "checkable": "partly", "machine_part": "Whether every use of a coded record matches a consent, objection or withdrawal on file for that identifier.", "human_part": "Whether the information given beforehand was sufficient.", "sources": [ "fedlex-hfg", "fedlex-hfv", "swissethics-genomic", "swissethics-docs", "bag-hfg-revision", "bag-hr-overview" ] }, { "id": "gumg-scope", "jurisdiction": "ch-research", "title": "Whether re-analysing sequence data on a computer is a \"genetic test\" is not settled", "body": "The Genetic Testing Act defines genetic tests as cytogenetic and molecular-genetic examinations and all other laboratory examinations (GUMG Art. 3(a)), and leaves tests done for research on human diseases and on the structure and function of the human body to the Human Research Act (Art. 2(4)). Neither provision says whether computational re-analysis of existing sequence data is a test. We have found no authority that answers it.", "articles": [ "GUMG Art. 2(4)", "GUMG Art. 3(a)" ], "binds": "Anyone performing or ordering genetic tests", "force": "law", "checkable": "human", "machine_part": "Nothing the text defines.", "human_part": "Whether a given computational analysis is a test under the Act.", "sources": [ "fedlex-gumg" ] }, { "id": "zertes-eu", "jurisdiction": "ch-research", "title": "A Swiss qualified signature is not yet recognised as qualified in the EU", "body": "ZertES, the Swiss electronic signature act, is unchanged since 2020; its technical rules were updated on 2025-11-01. Mutual recognition with the EU's eIDAS is at the stage of preparing a negotiating mandate, and the federal office writes that an agreement before the end of 2026 is unlikely. The Swiss e-ID, once expected on 2026-12-01, was postponed on 2026-06-30 with no new date; the state trust infrastructure is planned for the first half of 2027.", "quote": "ein Abschluss eines Abkommens vor Ende 2026 … wenig wahrscheinlich", "articles": [ "ZertES", "eIDAS" ], "binds": "Anyone relying on a Swiss qualified signature in the EU", "force": "law", "checkable": "partly", "machine_part": "Whether a signature is qualified under ZertES or eIDAS, checked against the trust lists.", "human_part": "What weight it carries before a court or authority in the other jurisdiction.", "sources": [ "fedlex-zertes", "bakom-esig", "bj-eid-planned", "bj-eid-postponed" ] }, { "id": "gdpr-erasure-append-only", "jurisdiction": "eu-dp", "title": "Erasure and append-only records pull in opposite directions", "body": "GDPR Article 17 requires erasure without undue delay when its conditions are met; the research exception in 17(3)(d) applies only where erasure is likely to render impossible or seriously impair the research. A processor contract must provide for deleting or returning all personal data at the end of the service (Art. 28(3)(g)). On 2026-10-01 an Advocate General advised the Court of Justice that striking an entry through while leaving it legible is not erasure, while making it unreadable so that the person can no longer be identified would be enough (C-12/25; an opinion, not a judgment). For a system that cannot delete, this decides what may be written to it at all.", "quote": "in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing", "articles": [ "GDPR Art. 17(1)", "17(3)(d)", "28(3)(g)", "C-12/25 (AG opinion)" ], "binds": "Controllers; processors through their contracts", "force": "law", "checkable": "partly", "machine_part": "Whether genetic data, or pseudonyms that can be reversed, are written to an append-only store at all.", "human_part": "Whether a value on the store is personal data for a given recipient, and whether the research exception applies.", "sources": [ "gdpr", "curia-c12-25" ] }, { "id": "edpb-hash-onchain", "jurisdiction": "eu-dp", "title": "A hash of personal data is still personal data — keep personal data off the chain", "body": "The EDPB's guidelines on blockchain became final (version 2.0) on 2026-07-07, with the key paragraphs unchanged from the consultation version. A hash of personal data is itself personal data, and unsalted or unkeyed hashes are in general not sufficient (§52). Personal data in clear, encrypted or hashed form should be stored off-chain (§104). Rather than personal data, it is better to store on-chain a pointer, a cryptographic commitment or a hash generated with a keyed hash function (§54); once the original data and its witness are deleted, a perfectly hiding commitment can no longer be linked back to them (§53). Guidelines are not law, but supervisory authorities apply them.", "quote": "the hash will also be considered personal data", "articles": [ "EDPB Guidelines 02/2025 v2.0 §52", "§53", "§54", "§104" ], "binds": "Controllers writing values derived from personal data to a blockchain", "force": "guidance", "checkable": "partly", "machine_part": "Whether on-chain hashes are keyed or salted, and what each on-chain field is derived from.", "human_part": "Whether the underlying data are personal data, and whether a salt is strong enough.", "sources": [ "edpb-blockchain-v2" ] }, { "id": "genetic-personal-default", "jurisdiction": "eu-dp", "title": "Genetic data is personal data by default, and \"anonymous\" is a claim regulators are testing", "body": "The EDPB's draft guidelines on scientific research (1/2026, consultation version) say genetic profiles are personal data by default and that the risk reaches relatives, permanently (§165, §167). Its draft guidelines on anonymisation (02/2026, consultation until 2026-10-30) set three tests: no record isolation (no combination of attributes unique to one person), no linkage, and no inference. In May 2026 the French authority fined IQVIA €5 million after rejecting its argument that pseudonymised health data were anonymous; in February 2026 the Conseil d'État held that pseudonymised data count as anonymous only where the risk of re-identification is insignificant.", "quote": "Genetic data profiles are considered to be personal data by default", "articles": [ "EDPB Guidelines 1/2026 §165 (draft)", "EDPB Guidelines 02/2026 (draft)" ], "binds": "Controllers claiming data are anonymous", "force": "draft", "checkable": "partly", "machine_part": "How many records carry a combination of attributes unique to one person.", "human_part": "Whether linkage or inference remains possible.", "sources": [ "edpb-research", "edpb-anonymisation", "cnil-iqvia", "conseil-etat-498628" ] }, { "id": "gdpr-dpia", "jurisdiction": "eu-dp", "title": "Large-scale genetic data needs an impact assessment before processing starts", "body": "Article 35 requires a data protection impact assessment before processing that is likely to be high-risk, and names large-scale processing of special categories, which include genetic data, as one such case (35(3)(b)). National lists word it differently: the Netherlands lists large-scale processing and/or systematic monitoring of genetic data; Germany, genetic data combined with at least one more risk criterion; Spain lists genetic data for any purpose as a criterion and expects an assessment in most cases where two criteria meet — which genetic data, also being a special category, does on its own.", "quote": "prior to the processing", "articles": [ "GDPR Art. 35(1)", "35(3)(b)" ], "binds": "Controllers; processors assist", "force": "law", "checkable": "partly", "machine_part": "That an assessment exists and is dated before processing began.", "human_part": "Whether the processing is \"large scale\" — and which national list applies.", "sources": [ "gdpr", "dpia-list-nl", "dpia-list-de", "dpia-list-es" ] }, { "id": "gdpr-records", "jurisdiction": "eu-dp", "title": "The record of processing activities, and why small organisations are not exempt here", "body": "Article 30 lists what a record of processing must contain. Organisations under 250 employees are exempt, but not when they process special categories such as genetic data (30(5)).", "articles": [ "GDPR Art. 30(1)", "30(2)", "30(5)" ], "binds": "Controllers and processors, each", "force": "law", "checkable": "machine", "machine_part": "Whether every required field of the record is filled in.", "human_part": "Whether what the record says is true — outside what a check of the record can see.", "sources": [ "gdpr" ] }, { "id": "gdpr-breach-security", "jurisdiction": "eu-dp", "title": "Breaches: 72 hours to notify — and a genetic-data fine for weak security and late notice", "body": "Article 33 requires notifying the supervisory authority within 72 hours of becoming aware of a breach, documenting every breach (33(5)), and processors to tell the controller without undue delay. Article 32 names pseudonymisation, encryption and regular testing among the measures. The Spanish authority fined 23andMe €2.4 million (€2.0 million under Art. 5(1)(f), €0.4 million under Art. 33); two secondary sources report different decision dates.", "quote": "not later than 72 hours after having become aware of it", "articles": [ "GDPR Art. 32(1)", "33(1)", "33(2)", "33(5)" ], "binds": "Controllers; processors notify the controller", "force": "law", "checkable": "partly", "machine_part": "The time between becoming aware and notifying, whether a breach register exists, and whether encryption and multi-factor authentication are configured.", "human_part": "How high the risk is, and whether the security level matches it.", "sources": [ "gdpr", "aepd-23andme" ] }, { "id": "gdpr-representative", "jurisdiction": "eu-dp", "title": "A controller outside the EU processing genetic data at scale needs an EU representative", "body": "A controller or processor outside the EU that is caught by Article 3(2) must designate a representative in the Union in writing. The exemption requires processing that is occasional, does not include large-scale processing of special categories, and is unlikely to be risky — all three — so it is not available for large-scale genetic data.", "quote": "shall designate in writing a representative in the Union", "articles": [ "GDPR Art. 27(1)", "27(2)(a)", "Art. 3(2)" ], "binds": "Controllers and processors outside the EU caught by Art. 3(2)", "force": "law", "checkable": "partly", "machine_part": "Whether a written designation exists.", "human_part": "Whether Article 3(2) applies at all.", "sources": [ "gdpr" ] }, { "id": "cra-reporting", "jurisdiction": "eu-dp", "title": "Cyber Resilience Act: actively exploited vulnerabilities reported within 24 hours since 2026-09-11", "body": "Manufacturers of products with digital elements placed on the EU market must send an early warning within 24 hours and a notification within 72 hours; Article 14 applies from 2026-09-11, and ENISA's single reporting platform opened that day. Supplying free and open-source software that is not monetised is not a commercial activity; open-source stewards carry Article 24 duties without fines (Art. 64(10)), and their reporting duty starts on 2027-12-11.", "quote": "Article 14 shall apply from 11 September 2026", "articles": [ "CRA Art. 14", "Art. 24", "Art. 64(10)", "Art. 71(2)" ], "binds": "Manufacturers; open-source stewards from 2027-12-11", "force": "law", "checkable": "partly", "machine_part": "The time between becoming aware of an exploited vulnerability and the early warning.", "human_part": "Whether a vulnerability is actively exploited, and whether the supplier is a manufacturer, a steward or neither.", "sources": [ "cra-regulation", "cra-reporting-page", "cra-open-source" ] }, { "id": "dsv-logging", "jurisdiction": "ch-dp", "title": "Large-scale sensitive data: log every access, and keep the log a year, apart from the system", "body": "Private controllers and processors that process sensitive data — genetic data included — on a large scale, where preventive measures alone cannot protect it, must log at least storage, modification, disclosure, deletion and destruction, and, since 2025-12-01, access to the data (DSV Art. 4(1); the word was previously \"reading\"). Logs are kept for at least one year, separately from the system (Art. 4(5)). Article 5 adds a processing regulation that must be kept regularly up to date. An append-only record is the natural shape of such a log. Two of our checking agents disagreed on whether this requirement is machine-checkable: the log's fields, retention and separation are; whether the duty applies at all is not.", "quote": "zumindest das Speichern, Verändern, Bekanntgeben, Löschen und Vernichten der Daten sowie das Zugreifen auf die Daten protokollieren", "articles": [ "DSV Art. 4(1)", "4(4)", "4(5)", "Art. 5" ], "binds": "Private controllers and processors of sensitive data at large scale", "force": "law", "checkable": "partly", "machine_part": "Whether each log entry records who, what, when and to whom; whether logs are kept a year, separately from the system; whether the processing regulation exists and when it was last updated.", "human_part": "Whether processing is \"large scale\" and whether preventive measures alone are insufficient — the law gives no number.", "sources": [ "fedlex-dsv" ] }, { "id": "fadp-dpia-breach", "jurisdiction": "ch-dp", "title": "Impact assessments and breach notices under the FADP: no hour count, but health data presumed high-risk", "body": "An impact assessment is required for extensive processing of sensitive data (DSG Art. 22(2)(a)) and kept for at least two years after processing ends (DSV Art. 14). A breach likely to cause high risk is notified to the Federal Data Protection and Information Commissioner \"as soon as possible\" (Art. 24(1)) — there is no fixed number of hours, unlike the GDPR's 72 — and the Commissioner's guide says that for health and biometric data a high risk is to be assumed in many cases. Separately, the operators listed in the Information Security Act — among them health institutions on a cantonal hospital list and laboratories licensed under the Epidemics Act — must report cyber attacks meeting its criteria within 24 hours of discovery (ISG Art. 74b, 74d, 74e).", "quote": "so rasch als möglich", "articles": [ "DSG Art. 22(2)(a)", "Art. 24(1)", "DSV Art. 14", "ISG Art. 74b", "74d", "74e" ], "binds": "Controllers; processors inform the controller", "force": "law", "checkable": "partly", "machine_part": "Whether an assessment exists and its dates; the time from detection to notice.", "human_part": "Whether the processing is \"extensive\" and the risk \"high\".", "sources": [ "fedlex-dsg", "fedlex-dsv", "edoeb-breach-guide", "fedlex-isg", "gdpr" ] }, { "id": "fadp-transfer", "jurisdiction": "ch-dp", "title": "Disclosure abroad: a list a machine can check, and safeguards it cannot", "body": "Personal data may go abroad without further safeguards only to countries the Federal Council lists as adequate (DSG Art. 16(1), DSV Annex 1): 44 entries, last changed on 2024-09-15, with the United States limited to companies certified under the Swiss-US Data Privacy Framework. Elsewhere, the safeguards of Art. 16(2) are needed, unless one of the exceptions in Art. 17 applies, such as consent or a contract with the person concerned. Data from the EU to Switzerland need no transfer instrument: the EU's adequacy decision for Switzerland was confirmed on 2024-01-15.", "articles": [ "DSG Art. 16(1)", "16(2)", "Art. 17", "DSV Annex 1" ], "binds": "Controllers and processors disclosing personal data abroad", "force": "law", "checkable": "partly", "machine_part": "Whether each destination is on the 44-entry list, and for the US whether the recipient is certified.", "human_part": "Whether the safeguards for any other country are adequate, or whether an Art. 17 exception applies.", "sources": [ "fedlex-dsg", "bj-adequate-countries", "eu-adequacy-ch" ] }, { "id": "fadp-deletion-consent", "jurisdiction": "ch-dp", "title": "No free-standing right to erasure — but data must be destroyed or anonymised once no longer needed", "body": "The FADP has no erasure article like GDPR Article 17. Instead, Article 6(4) requires destroying or anonymising data once they are no longer needed for the purpose, and a person can sue for deletion (Art. 32(2)(c)). Processing sensitive data on the basis of consent needs express consent (Art. 6(7)(a)). For research, Article 31(2)(e) can justify processing if the data are anonymised as soon as the purpose allows and results are published so that no one can be identified. The Commissioner's annual report of 2026-06-30 takes the view that the current Act already allows research reuse: it can be justified under Articles 31 and 39 if their conditions are met.", "quote": "vernichtet oder anonymisiert, sobald sie zum Zweck der Bearbeitung nicht mehr erforderlich sind", "articles": [ "DSG Art. 6(4)", "6(7)(a)", "31(2)(e)", "32(2)(c)" ], "binds": "Controllers", "force": "law", "checkable": "partly", "machine_part": "Whether a retention period is declared and deletion or anonymisation is recorded on time; whether an express consent is on file.", "human_part": "Whether the data are still \"needed\", and whether a hash kept in an append-only record is personal data.", "sources": [ "fedlex-dsg", "edoeb-annual-report" ] } ], "timeline": [ { "date": "2025-12-01", "status": "past", "what": "Swiss DSV Art. 4(1): the logging duty covers access to the data, not only reading.", "source": "fedlex-dsv" }, { "date": "2025-12-18", "status": "past", "what": "US Public Law 119-60, section 851 (commonly called the BIOSECURE Act), enacted.", "source": "biosecure-pl" }, { "date": "2026-02-13", "status": "past", "what": "French Conseil d'État: pseudonymised data are anonymous only where re-identification risk is insignificant.", "source": "conseil-etat-498628" }, { "date": "2026-05-26", "status": "past", "what": "CNIL fines IQVIA €5 million over health data it called anonymous.", "source": "cnil-iqvia" }, { "date": "2026-06-30", "status": "past", "what": "Swiss e-ID launch postponed; no new date.", "source": "bj-eid-postponed" }, { "date": "2026-07-07", "status": "past", "what": "EDPB blockchain guidelines final (v2.0); anonymisation guidelines open for consultation.", "source": "edpb-blockchain-v2" }, { "date": "2026-09-11", "status": "applying", "what": "Cyber Resilience Act reporting obligations apply.", "source": "cra-reporting-page" }, { "date": "2026-09-28", "status": "past", "what": "Council adopts its first-reading position on the EU pharmaceutical package, which amends the Clinical Trials Regulation.", "source": "council-pharma-package" }, { "date": "2026-10-01", "status": "past", "what": "Advocate General in C-12/25: a legible strike-through is not erasure.", "source": "curia-c12-25" }, { "date": "2026-10-30", "status": "future", "what": "EDPB consultation on the anonymisation guidelines closes.", "source": "edpb-anonymisation" }, { "date": "2027-01-15", "status": "future", "what": "ICH E6(R3) Annex 2 applies in the EU. FDA still lists it as draft; no Swiss date found.", "source": "ich-e6r3-ema" }, { "date": "2027-04-02", "status": "future", "what": "GDPR procedural regulation (EU) 2025/2518 applies to new cross-border cases.", "source": "gdpr-procedural" }, { "date": "2027-12-11", "status": "future", "what": "Cyber Resilience Act reporting duty for open-source stewards starts.", "source": "cra-open-source" } ], "genomicschain": { "intro": "Where these requirements touch our own design. This is our reading of our own position, published so it can be checked and contradicted; no authority has agreed with it.", "facts_we_state_about_ourselves": [ "Our provenance records are append-only and identify outputs by hash. They hold hashes of analysis outputs and of execution conditions.", "We plan to sign records with ZertES. Until mutual recognition with eIDAS exists, such a signature is not a qualified signature in the EU.", "Our assessment code is published under the MIT licence.", "A check we build against these requirements would report the machine part and hand the human part to a person. It would never output \"compliant\": there is no field for that word." ], "undecided_for_us": [ { "q": "Is a hash of an analysis output derived from human genomic data personal data? The EDPB says a hash of personal data is; whether an output such as a count matrix is personal data is the open step.", "articles": [ "EDPB 02/2025 §52", "GDPR Art. 4(1)" ] }, { "q": "If it is, can an append-only record that holds it meet an erasure request, given the Advocate General's reading in C-12/25?", "articles": [ "GDPR Art. 17", "DSG Art. 6(4)" ] }, { "q": "Under the Cyber Resilience Act, are we a manufacturer, an open-source steward, or neither?", "articles": [ "CRA Art. 24", "Art. 64(10)" ] }, { "q": "Is computational re-analysis of existing sequence data a genetic test under the Swiss Genetic Testing Act?", "articles": [ "GUMG Art. 3(a)" ] } ] }, "sources": [ { "id": "ich-e6r3-ema", "label": "EMA page for ICH E6(R3) Good Clinical Practice, with Annex 1, Annex 2 and the consolidated text", "url": "https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "ich-e6-r3-annex-2" }, { "id": "fda-e6r3-fr", "label": "Federal Register 2025-17311 — FDA final guidance E6(R3) and Annex 1, 2025-09-09", "url": "https://www.federalregister.gov/documents/2025/09/09/2025-17311", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A published notice. A later change would be a new notice." }, { "id": "swissmedic-e6r3", "label": "Swissmedic — introduction of ICH E6(R3) in Switzerland", "url": "https://www.swissmedic.ch/swissmedic/en/home/news/mitteilungen/einfuehrung-leitlinie-ich-gcp-e6-r3.html", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "swissmedic-ich-e6r3" }, { "id": "ema-cs-guideline", "label": "EMA guideline on computerised systems and electronic data in clinical trials, EMA/INS/GCP/112288/2023", "url": "https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-and-electronic-data-clinical-trials_en.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "ema-computerised-systems-gcp", "watch_note": "A PDF, so the watch compares raw bytes. Sections 4.4, 6.2.1, 6.6 and 6.10 were re-read against the PDF on 2026-10-03." }, { "id": "eu-ctr", "label": "Regulation (EU) No 536/2014 on clinical trials, Official Journal", "url": "https://eur-lex.europa.eu/eli/reg/2014/536/oj", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the Publications Office Cellar SPARQL endpoint, which holds the same documents as EUR-Lex and lists every consolidated version, corrigendum and amending act of this act. A change in that list means the text moved and must be read; the scan does not say what changed. EUR-Lex itself still refuses automated clients.", "watch_id": "eurlex-ctr-versions" }, { "id": "council-pharma-package", "label": "Council of the EU — Commission communication COM(2026) 527 recording the Council position on the pharmaceutical package, adopted 2026-09-28", "url": "https://data.consilium.europa.eu/doc/document/ST-13768-2026-INIT/en/pdf", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "immutable", "watch_note": "A dated Council document. The next step is the Parliament's second reading, which this document cannot show." }, { "id": "ema-fda-ai-principles", "label": "EMA and FDA — guiding principles of good AI practice in drug development, 2026-01", "url": "https://www.ema.europa.eu/en/documents/other/guiding-principles-good-ai-practice-drug-development_en.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "ema-fda-ai-principles" }, { "id": "fda-ai-drug-guidance", "label": "FDA draft guidance FDA-2024-D-4689 — AI to support regulatory decision-making for drugs and biologics", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "fda-ai-drug-decision-guidance" }, { "id": "ecfr-part11", "label": "21 CFR Part 11 — electronic records and signatures (eCFR)", "url": "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "ecfr-part11-versions", "watch_note": "Watched through the eCFR version history, which moves when the Part is amended. Last amended 2023-03-02." }, { "id": "fda-part11-scope", "label": "FDA guidance — Part 11 scope and application (2003)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "fda-part11-scope-guidance" }, { "id": "fda-electronic-systems-qa", "label": "FDA Q&A — electronic systems, records and signatures in clinical investigations (FDA-2017-D-1105)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/electronic-systems-electronic-records-and-electronic-signatures-clinical-investigations-questions", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "fda-electronic-systems-qa" }, { "id": "doj-data-security", "label": "US Department of Justice — Data Security Program (28 CFR Part 202)", "url": "https://www.justice.gov/nsd/data-security", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "doj-data-security-program" }, { "id": "ecfr-part202", "label": "28 CFR Part 202 — access to US sensitive personal data by countries of concern (eCFR)", "url": "https://www.ecfr.gov/current/title-28/chapter-I/part-202", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_id": "ecfr-part202-versions", "watch_note": "Watched through the eCFR version history. The thresholds and the list of countries of concern are read from here, not from the DOJ overview page." }, { "id": "biosecure-pl", "label": "Public Law 119-60 (National Defense Authorization Act), section 851 — BIOSECURE", "url": "https://www.congress.gov/119/plaws/publ60/PLAW-119publ60.pdf", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "An enacted law as published." }, { "id": "fr-dod-list", "label": "Federal Register 2026-11571 — Department of Defense list, 2026-06-10", "url": "https://www.federalregister.gov/documents/2026/06/10/2026-11571", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A published notice; a revised list would be a new notice." }, { "id": "fedlex-hfg", "label": "Human Research Act (HFG), SR 810.30, version of 2023-09-01", "url": "https://www.fedlex.admin.ch/eli/cc/2013/617/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-hfg-versions" }, { "id": "fedlex-hfv", "label": "Human Research Ordinance (HFV), SR 810.301, version of 2024-11-01", "url": "https://www.fedlex.admin.ch/eli/cc/2013/642/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-hfv-versions" }, { "id": "swissethics-genomic", "label": "swissethics — announcement of the genomic research information and consent template, 2025-11-11", "url": "https://swissethics.ch/news/2025/11/11/information-und-einwilligung-fuer-genomische-forschung", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A dated announcement. Whether the template leaves review is watched on the documents page." }, { "id": "swissethics-docs", "label": "swissethics — General Consent documents page", "url": "https://swissethics.ch/en/documents/generalkonsent", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "swissethics-general-consent" }, { "id": "bag-hfg-revision", "label": "Federal Office of Public Health — revision of the Human Research Act", "url": "https://www.bag.admin.ch/de/humanforschung-revision-hfg-stfg", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "bag-hfg-revision" }, { "id": "bag-hr-overview", "label": "Federal Office of Public Health — overview of human research regulation in Switzerland", "url": "https://www.bag.admin.ch/de/die-regelung-der-humanforschung-in-der-schweiz", "kind": "official-guidance", "checked_on": "2026-10-04", "watch_status": "watched", "watch_id": "bag-hr-overview", "watch_note": "Says \"bis Ende 2026 einen Gesetzesentwurf\" while the revision page says consultation in Q2 2027." }, { "id": "fedlex-gumg", "label": "Genetic Testing Act (GUMG), SR 810.12, version of 2025-08-01", "url": "https://www.fedlex.admin.ch/eli/cc/2022/537/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-gumg-versions" }, { "id": "bakom-esig", "label": "Federal Office of Communications — electronic signature (ZertES) and recognition with the EU", "url": "https://www.bakom.admin.ch/de/elektronische-signatur", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "bakom-electronic-signature" }, { "id": "fedlex-zertes", "label": "Federal Act on Electronic Signatures (ZertES), SR 943.03, version of 2020-01-01", "url": "https://www.fedlex.admin.ch/eli/cc/2016/752/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-zertes-versions" }, { "id": "bj-eid-planned", "label": "Federal Department of Justice and Police — e-ID launch expected 2026-12-01, 2026-02-25", "url": "https://www.bj.admin.ch/de/newnsb/L6Nbf7gStnDm", "kind": "official-guidance", "checked_on": "2026-10-04", "watch_status": "immutable", "watch_note": "A dated announcement, superseded by the postponement of 2026-06-30." }, { "id": "bj-eid-postponed", "label": "Federal Office of Justice — e-ID launch postponed, 2026-06-30", "url": "https://www.bj.admin.ch/de/newnsb/4ZNYpSk3J1-U", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A dated announcement." }, { "id": "gdpr", "label": "Regulation (EU) 2016/679 (GDPR), Official Journal", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the Publications Office Cellar SPARQL endpoint, which holds the same documents as EUR-Lex and lists every consolidated version, corrigendum and amending act of this act. A change in that list means the text moved and must be read; the scan does not say what changed. EUR-Lex itself still refuses automated clients.", "watch_id": "eurlex-gdpr-versions" }, { "id": "gdpr-procedural", "label": "Regulation (EU) 2025/2518 — GDPR procedural rules", "url": "https://data.europa.eu/eli/reg/2025/2518/oj", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "gdpr-procedural-regulation-applies", "watch_note": "On the watchlist as a dated trigger, fetched through the Publications Office Cellar list of its versions, corrigenda and amending acts." }, { "id": "curia-c12-25", "label": "Court of Justice press release — Advocate General's opinion in C-12/25, 2026-10-01", "url": "https://curia.europa.eu/site/upload/docs/application/pdf/2026-10/cp260139en.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A dated press release about a non-binding opinion. The judgment, when it comes, is a separate document." }, { "id": "edpb-blockchain-v2", "label": "EDPB Guidelines 02/2025 on processing of personal data through blockchain technologies, version 2.0", "url": "https://www.edpb.europa.eu/system/files/2026-07/edpb_guidelines_202502_blockchain_v2_en.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "edpb-blockchain-guidelines", "watch_note": "Watched through the EDPB guidelines index, where a v3 would first appear." }, { "id": "edpb-research", "label": "EDPB Guidelines 1/2026 on processing for scientific research — consultation version", "url": "https://www.edpb.europa.eu/public-consultations/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "edpb-scientific-research-guidelines" }, { "id": "edpb-anonymisation", "label": "EDPB Guidelines 02/2026 on anonymisation — consultation version", "url": "https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "edpb-anonymisation-guidelines" }, { "id": "cnil-iqvia", "label": "CNIL — €5 million fine against IQVIA over health data, 2026-05", "url": "https://www.cnil.fr/en/health-data-fine-5-million-euros-against-iqvia", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A dated decision notice." }, { "id": "conseil-etat-498628", "label": "Conseil d'État, decision n° 498628, 2026-02-13", "url": "https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-02-13/498628", "kind": "primary", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A judgment as delivered." }, { "id": "dpia-list-nl", "label": "Netherlands — list of processing requiring a DPIA (Stcrt. 2019-64418)", "url": "https://zoek.officielebekendmakingen.nl/stcrt-2019-64418.html", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A published list from 2019; a revision would be a new publication, which this entry cannot catch." }, { "id": "dpia-list-de", "label": "Germany — DSK list of processing requiring a DPIA, version 1.1 (2018)", "url": "https://www.datenschutzkonferenz-online.de/media/ah/20181017_ah_DSK_DSFA_Muss-Liste_Version_1.1_Deutsch.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A versioned list; a new version would be a new document." }, { "id": "dpia-list-es", "label": "Spain — AEPD list of processing requiring a DPIA (2019)", "url": "https://www.aepd.es/sites/default/files/2019-09/listas-dpia-en-35-4.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A published list from 2019." }, { "id": "aepd-23andme", "label": "AEPD decision PS/00140/2025 — 23andMe", "url": "https://www.aepd.es/documento/ps-00140-2025.pdf", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A decision as published. Its date is reported differently by two secondary sources and could not be fixed from the text." }, { "id": "cra-reporting-page", "label": "European Commission — Cyber Resilience Act reporting obligations", "url": "https://digital-strategy.ec.europa.eu/en/policies/cra-reporting", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "cra-reporting-page" }, { "id": "cra-open-source", "label": "European Commission — Cyber Resilience Act and open source", "url": "https://digital-strategy.ec.europa.eu/en/policies/cra-open-source", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "cra-steward-reporting" }, { "id": "cra-regulation", "label": "Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal", "url": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the Publications Office Cellar SPARQL endpoint, which holds the same documents as EUR-Lex and lists every consolidated version, corrigendum and amending act of this act. A change in that list means the text moved and must be read; the scan does not say what changed. EUR-Lex itself still refuses automated clients.", "watch_id": "eurlex-cra-versions" }, { "id": "fedlex-dsv", "label": "Data Protection Ordinance (DSV), SR 235.11, version of 2025-12-01", "url": "https://www.fedlex.admin.ch/eli/cc/2022/568/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-dsv-versions" }, { "id": "fedlex-dsg", "label": "Federal Act on Data Protection (DSG), SR 235.1, version of 2025-07-07", "url": "https://www.fedlex.admin.ch/eli/cc/2022/491/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-dsg-versions" }, { "id": "fedlex-isg", "label": "Information Security Act (ISG), SR 128, version of 2025-10-01", "url": "https://www.fedlex.admin.ch/eli/cc/2022/232/de", "kind": "primary", "checked_on": "2026-10-04", "watch_status": "watched", "watch_note": "Watched through the official fedlex SPARQL endpoint, which lists every consolidated version of the act. A new version of the text always appears as a new entry there, so a change in the list means the text moved and must be read; the scan does not say what changed.", "watch_id": "fedlex-isg-versions" }, { "id": "edoeb-breach-guide", "label": "FDPIC guide on data security breaches, v1.2 (2025-04-23)", "url": "https://www.edoeb.admin.ch/de/leitfaden-data-breach", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "edoeb-data-breach-guide" }, { "id": "bj-adequate-countries", "label": "Federal Office of Justice — countries with adequate data protection (DSV Annex 1)", "url": "https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "watched", "watch_id": "bj-adequate-countries" }, { "id": "eu-adequacy-ch", "label": "FDPIC — EU adequacy decision regarding Switzerland confirmed, 2024-01-15", "url": "https://www.edoeb.admin.ch/en/15012024-eu-adequacy-decision-regarding-switzerland", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "A dated statement." }, { "id": "edoeb-annual-report", "label": "FDPIC annual reports (33rd report, 2026-06-30)", "url": "https://www.edoeb.admin.ch/de/taetigkeitsbericht-des-edob", "kind": "official-guidance", "checked_on": "2026-10-03", "watch_status": "immutable", "watch_note": "The 33rd report as published; a later report is a new document." } ], "changelog": [ { "version": "0.1.0", "date": "2026-10-04", "what": "First version. Built from the 2026-10-03 agent-team check of EU clinical-trial rules, US rules, Swiss research law, EU data protection, the GDPR and the Swiss data protection act. Before publication, independent checking agents found and this version corrects: a Council citation that did not show the adoption date; an unsupported clause about expected FDA finalisation; \"BIOSECURE\" used as if it were the statutory name; an over-broad \"no opt-out for genetics\" (anonymisation for research is opt-out, HFG Art. 32(3)); the ISG reporting duty attributed to the wrong article and stated too broadly; transfers abroad stated without the Art. 17 exceptions; the FDPIC's research-reuse view stated more strongly than the report; EDPB §53 described as a preference; the first anonymisation test misnamed; the Dutch and Spanish DPIA lists misdescribed; \"two fines\" where one decision is cited; and a CRA quotation attributed to pages that do not carry it. The seven Swiss statutes are watched through the fedlex SPARQL endpoint's list of consolidated versions, so claims resting on them can be re-checked by machine; until this change they were carried as unwatchable. The three EU acts it rests on (GDPR, Clinical Trials Regulation, Cyber Resilience Act) are watched through the Publications Office Cellar list of versions, corrigenda and amending acts." } ] }