# Data Protection Management Software

> Swiss GRC bietet mit der SwissGRC® Platform eine Software für das Datenschutzmanagement. Sie richtet sich an Organisationen, die Verarbeitungsverzeichnis, DSFA, TIA, Datenschutzverletzungen und Betroffenenanfragen nachweisbar in einem System führen wollen.

- URL: https://swissgrc.com/en/data-protection-management-software/
- Publisher: SwissGRC®
- Published: 2023-02-27
- Last updated: 2026-10-07

## Key facts

- Die SwissGRC® Platform bildet Verarbeitungsverzeichnis, Datenschutz-Folgenabschätzung (DPIA), Transfer Impact Assessment (TIA), Datenschutzverletzungen, Betroffenenanfragen und Reporting in einem System ab.
- Das Verzeichnis der Verarbeitungstätigkeiten entspricht Art. 30 DSGVO und dem revDSG und ist mit Auftragsverarbeitern, Verträgen und Systemen verknüpft.
- Die Pflichten je anwendbarer Rechtsordnung stammen aus einem gepflegten Katalog, der Schweizer und EU-Recht sowie internationale Datenschutzgesetze umfasst.
- Das Datenschutzmanagement nutzt dieselbe Basis wie ISMS, TPRM, IKS, Compliance und Vertragsmanagement der Plattform.
- Fristen wie die 72 Stunden bei Datenschutzverletzungen werden über Workflows und automatische Erinnerungen überwacht.
- Swiss GRC betreibt die Plattform nach ISO 27001, 27017 und 27701, den Standards, die auch für das Datenschutzmanagementsystem der Kunden abgebildet werden.

Data protection management

# Stricter privacy laws every year. Where is your evidence?

Records of processing, DPIA, TIA, breaches and data subject rights on one platform: Swiss GRC makes your privacy programme evidenced across every relevant jurisdiction.

[Request a demo](https://swissgrc.com/en/data-protection-management-software/#kontakt) [Explore features](https://swissgrc.com/en/data-protection-management-software/#funktionen)

Trusted by leading organizations

What makes the difference

## From a privacy island to evidenced compliance

Records, DPIAs and breach handling are long established. The difference lies in whether they work together across jurisdictions and disciplines.

The common starting point

### Tools side by side, evidence by hand

A separate privacy tool next to the ISMS and TPRM leads to duplicated master data and to evidence that only comes together for the audit.

- Records, DPIAs and contracts in separate systems
- Every new jurisdiction means manual work all over again
- Deadlines such as 72 hours rest on individual people
- Data flows to processors are not visible end to end

With the SwissGRC® platform

### One record, every duty evidenced

Processing activities stay connected to legal bases, risks, processors, contracts and actions. Evidence is available at any time, for every applicable jurisdiction.

- The record of processing is the shared basis for every duty
- Jurisdictions come from the catalogue, not from manual work
- Deadlines and notification paths driven by workflows
- Same basis as ISMS, TPRM, ICS and contract management

The SwissGRC® platform at a glance

## Your entire privacy work, in one place

Record, assess, notify, respond and report. Click through the six views.

Record of processing activities

### Every processing activity documented and linked

All processing activities in one structure, with purpose, legal basis, data categories, recipients and retention. **Ready to answer authorities and data subjects**.

- Complete record under Art. 30 GDPR and revFADP
- Data categories, recipients and retention on file
- Linked to processors, contracts and systems

![Record of processing activities in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/DPProcessingActivity-1024x569.png)

Data Protection Impact Assessment

### High risk identified before processing starts

The DPIA as a structured risk assessment before processing begins, with freely definable criteria and **actions attached to the risk**.

- Threshold check and full DPIA
- Risk matrix with gross and net assessment
- Actions with clear ownership and deadline

![Data Protection Impact Assessment in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/DPDPIA-1024x569.png)

Transfer Impact Assessment

### Third country transfers assessed and justified

For every transfer to a third country a documented assessment of the recipient country, the safeguards and the **supplementary measures**.

- TIA per recipient country and processor
- Safeguards and standard contractual clauses on file
- Supplementary measures documented and traceable

![Transfer Impact Assessment in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/TIA.png)

Data breach management

### Notification deadlines met without improvisation

Record, assess and notify breaches, with reminders and reports for supervisory authorities and data subjects. **The 72-hour deadline in view**.

- Assessment of the notification duty with rationale
- Deadlines and reminders monitored automatically
- Root cause analysis and actions at the breach

![Data breach management in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/DPDataBreach-1024x569.png)

Data subject requests

### Requests answered on time and evidenced

Access, rectification, erasure and portability as a guided process, from identity verification through to the **documented response**.

- Every request type in one workflow
- Identity verification and deadline control
- Response and evidence stored audit ready

![Data subject requests in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/DPRequests-1-1024x570.png)

Privacy reporting

### The state of your programme at a glance

One clear picture for management, the data protection officer and auditors: **coverage, open deadlines and risk position**.

- Coverage of records, DPIAs and TIAs made visible
- Open requests, breaches and deadlines in view
- Analyses for audit and management

![Privacy reporting dashboard in the SwissGRC platform](https://swissgrc.com/en/wp-content/uploads/sites/2/2023/04/DPDashboard-1024x572.png)

Built on **recognized standards and a maintained catalogue of jurisdictions**, from Swiss and EU law to international privacy legislation.

ISO/IEC 27701:2025 ISO 27001 EU GDPR revFADP international privacy laws

Regulatory status 2026

## The law keeps moving, your evidence stays current

Privacy law keeps growing and changing. These four developments shape the privacy year 2026.

EU

Digital Omnibus

The Commission is negotiating amendments to the GDPR, among them the definition of personal data and pseudonymisation. Political agreement is targeted for 2026.

UK

Data (Use and Access) Act 2025

The data protection provisions came into force on 5 February 2026, introducing recognised legitimate interests and relaxed rules for automated decision making.

India

DPDP Rules 2025

Notified on 14 November 2025. The transition period runs until November 2026, with full enforcement following in May 2027.

ISO

ISO/IEC 27701:2025

Since 14 October 2025 the standard for privacy information management systems is certifiable on its own and no longer requires ISO 27001 as a basis.

Jurisdictions and standards

See which standards, laws and frameworks the platform covers in our overview.

[View standards and frameworks](https://swissgrc.com/en/standards-frameworks/)

Advantages and added value

## More evidence, fewer tools

Comprehensive and simple at the same time. That drives adoption and makes privacy defensible.

#### One record for every duty

Capture processing activities once, then records, DPIAs, TIAs and data subject rights all build on them.

#### Part of one connected GRC system

Privacy shares the same basis as ISMS, TPRM, ICS, compliance and contract management, no separate silo.

#### International, not just GDPR

From revFADP and GDPR to further international privacy legislation: duties per applicable jurisdiction.

#### Data flows and processors in view

Processing activities linked to systems, processors and contracts, including transfers abroad.

#### Certified to ISO 27001, 27017 and 27701

We run the platform to the same standards that we map for your privacy management system.

#### Deadlines reliably met

Notification deadlines, data subject requests and actions with ownership, due date and automatic reminders.

Contact and demo

## Experience the platform in a live demo

In a personal live demo we walk you through the solution, from records to evidence, and answer your questions.

[Request a demo](https://swissgrc.com/en/demo) [Contact sales](https://swissgrc.com/en/sales)

## Frequently asked questions

### Was umfasst die Datenschutzmanagement-Software von Swiss GRC?

Sie umfasst das Verzeichnis der Verarbeitungstätigkeiten, die DPIA, das Transfer Impact Assessment, das Management von Datenschutzverletzungen, Betroffenenanfragen und das Datenschutz-Reporting. Alles läuft auf der SwissGRC® Platform.

### Welche Datenschutzgesetze deckt die Plattform ab?

Die Plattform deckt Schweizer und EU-Recht ab, darunter revDSG und DSGVO, sowie internationale Datenschutzgesetze. Die Rechtsordnungen kommen aus einem gepflegten Katalog.

### Wie unterstützt die Software die 72-Stunden-Meldefrist bei Datenschutzverletzungen?

Verletzungen werden erfasst, bewertet und gemeldet. Fristen und Erinnerungen werden automatisch überwacht, und Berichte für Aufsichtsbehörden und betroffene Personen sind vorgesehen.

### Wie werden Betroffenenanfragen bearbeitet?

Auskunft, Berichtigung, Löschung und Datenübertragbarkeit laufen als geführter Prozess in einem Workflow. Er reicht von der Identitätsprüfung bis zur dokumentierten Antwort, mit Fristenkontrolle.

### Ist ISO/IEC 27701 ein Thema auf der Seite?

Ja. Die Seite nennt, dass ISO/IEC 27701:2025 seit dem 14. Oktober 2025 eigenständig zertifizierbar ist und ISO 27001 nicht mehr als Grundlage voraussetzt.