- Information sheet of the Data Protection Supervisory Authority BL explains order processing in accordance with §7 IDG-BL (same content as §6 IDG ZH).
- Instruction sheet contains appendix with tabular overview of the requirements for order processing.
- Risk analysis is required: Outsourcing may only take place if indispensable benefits justify increased risks.
- In the Canton of Zurich, the “Processing on behalf” guidelines must also be observed.
The data protection supervisory authority of the Canton of Basel-Land has issued a Instruction sheet “Data processing on behalf of within the meaning of § 7 IDG-BL (corresponds in content to § 6 of the IDG ZH).
The leaflet explains the concept of order processing and the applicability of the IDG-BL and contains a tabular overview of the requirements for order processing in an annex.
Among other things, an analysis is required of whether the risks for those affected by outsourcing increase (compared to an on-prem solution or an alternative offering), must be offset by “indispensable” advantages – that is probably a somewhat too absolute formulation:
If, due to the nature of the outsourcing (e.g., due to the possible loss of control in the case of cloud services), the remaining residual risk is still acceptable but higher compared to an equivalent solution “on premise” or compared to lower-risk solutions from other providers, the public body must explain in each individual case by which indispensable advantages the new risks are outweighed.
In the canton of Zurich, among others, the Guide “Machining on order to note.