privatim cloud Merkblatt v3.02 (2026)

privatim revises its cloud guidance for Swiss public bodies (Merkblatt v3.02, 2 October 2026): sensitive data stays under the body's own keys, standard SaaS from Microsoft, Google, AWS and SAP is in most cases inadmissible for secrecy-bound data, and top management signs the residual risk

privatim, the conference of the Swiss data-protection authorities, dates version 3.02 of its guidance "Cloud-specific risks and measures" to 2 October 2026 (privatim, 2026-10-02); it replaces the version of 3 February 2022 (DCOD, 2026-10-27). For particularly sensitive personal data the public body must encrypt, the keys may be available only to it, and outsourcing such data, or data under a statutory duty of confidentiality, to SaaS from large international providers, with Microsoft, Google, AWS and SAP named, is in most cases inadmissible because of the untenable risk (privatim, 2026-10-02). Keys may stay with the provider only where no untenable risk follows and the provider is bound by contract to use them only with the body's express consent and to log every access (privatim, 2026-10-02).

The body, or its top management, is to confirm in writing that it has understood the risks and accepts the residual risk, and data the cloud services generate about their users, such as telemetry and logging data, is to be treated with the same care and contract terms as the content data (privatim, 2026-10-02). The five risk areas are contract design, places of processing including foreign authority access, confidentiality with encryption and key management, user data, and sub-processors (privatim, 2026-10-02).