Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
Governance, Records and Accountability

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) CH-FADP-25: Compliance monitoring and auditing

Compliance monitoring and auditing. Control from Switzerland FADP framework, domain: Switzerland FADP: Accountability & Compliance.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 78 controls across 65 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

MTCS (Singapore) · 2 controls

  • MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles
  • MTCS-Scope-SS-584-Singapore-Standards-Council-IMDA-SAC-3-Tier-2013-2015-2020-2024-Certification MTCS Scope + SS 584 + Singapore Standards Council + IMDA + SAC + 3-Tier Framework + Certification

Nebraska Data Privacy Act · 2 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties

Nigeria Data Protection Act 2023 (NDPA) · 2 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance

SASB Standards · 2 controls

  • SASB-3 Leadership and Governance (LG)
  • SASB-LG-1 Business Ethics

Bahrain PDPL · 1 control

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 1 control

  • LOPDP-EC-Enforcement-Sanctions-Articles-66-76-SPDP-Investigation-Administrative-Fines-Tiered-Penalty-Habeas-Data Ecuador LOPDP Enforcement + Sanctions + Articles 66-76 + SPDP + Habeas Data

Family Educational Rights and Privacy Act (FERPA) · 1 control

FedRAMP High · 1 control

  • AC-2 Account Management

FedRAMP Moderate · 1 control

  • AC-2 Account Management

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Status UAE PDPL status, executive regulations, UAE Data Office guidance evolution

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

  • GLI33-Sports-Integrity-DataProviders-Compliance GLI-33 Sports Event Data Integrity, Provider Certification and Regulatory Reporting

GRI Standards · 1 control

IEEE 7000 · 1 control

  • IEEE7000-Scope-VBE-EAD-IEEE7000Family-EUAIAct-NIST-ISO42001-Coord IEEE 7000-2021 - Scope + Value-Based Engineering (VBE) + Ethically Aligned Design + IEEE 7000 Family + Coordination EU AI Act + NIST AI RMF + ISO/IEC 42001

ISMAP (Japan) · 1 control

ISSB Standards · 1 control

  • ISSB-IFRS-S1-Sources-SASB-Industry-Disclosures-Connected-Information-Reporting-Boundary ISSB IFRS S1 Sources of Guidance + SASB Standards Industry-Specific Disclosures + Connected Information + Reporting Boundary + Time of Reporting + Comparative Information + 11 SASB Sectors

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 1 control

India DPDP Act · 1 control

Indiana Consumer Data Protection Act · 1 control

  • INCDPA-Enforcement-30DayCure-AttorneyGeneralOnly-NoPrivateRight-CivilPenalties-7500-PerViolation Indiana CDPA Enforcement - Attorney General Exclusive + 30-Day Cure Period + No Private Right of Action + Civil Penalties Up to USD 7500 Per Violation + Investigation + Compliance

Indonesia PDP Law · 1 control

Iowa Consumer Data Protection Act · 1 control

Jamaica Data Protection Act 2020 · 1 control

Japan AI Guidelines · 1 control

  • JP-AIG-Accountability-Governance-AI-Inventory-Stakeholder-Engagement-Board-Reporting-Tone-at-Top Japan AI Guidelines Accountability + Governance + AI Inventory + Stakeholder Engagement + Board Reporting + Tone at Top + AI Ethics Committee + DPO + AI Officer + Regulatory Compliance + Multi-Stakeholder

Kentucky Consumer Data Protection Act · 1 control

LGPD · 1 control

  • LGPD-BR-Enforcement-Sanctions-ANPD-Article-52-55-Administrative-Sanctions-2-Percent-Turnover-50M-BRL Brazil LGPD Enforcement + Sanctions + Article 52 + 2% Turnover + 50M BRL + ANPD

Law No. 172-13 on the Protection of Personal Data · 1 control

  • DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Liechtenstein DPA · 1 control

Malaysia PDPA 2010 · 1 control

  • MY-PDPA-Enforcement-PDPC-Investigation-RM1M-Fine-3-Year-Prison-Class-Action-Section-104-2024-Amendment Malaysia PDPA Enforcement + PDPC Investigation + RM1M Fine + 3 Year Prison + Class Action + 2024 Amendment

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

  • MU-DPA-Enforcement-Commissioner-Section-41-43-MUR-200K-5-Year-Prison-ICT-Appeal-Tribunal-Supreme-Court Mauritius DPA Enforcement + Commissioner + Section 41 + Section 43 + MUR 200K + 5 Year Prison + ICT Appeal Tribunal + Supreme Court

Mexico LFPDPPP · 1 control

  • MX-LFPDPPP-Enforcement-INAI-Articles-63-64-67-320K-Days-Minimum-Wage-3-Year-Prison-TFJA-Recurso-Revision-SCJN Mexico LFPDPPP Enforcement + INAI + Articles 63-64-67 + 320K Days Minimum Wage + 3 Year Prison + TFJA + Recurso de Revision + SCJN

Minnesota Consumer Data Privacy Act · 1 control

  • MN-CDPA-Processor-Contract-Security-Section-325O-08-Pseudonymisation-Section-325O-09-De-Identification Minnesota CDPA Processor + Section 325O.08 + Security + Pseudonymisation + Section 325O.09 + De-Identification

Montana Consumer Data Privacy Act · 1 control

  • MT-CDPA-Processor-Contract-Security-MCA-30-14-2809-30-14-2811-Pseudonymisation-De-Identification Montana CDPA Processor + MCA 30-14-2809 + Security + Pseudonymisation + MCA 30-14-2811 + De-Identification

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-122 · 1 control

  • NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-144 · 1 control

  • NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation

NIST SP 800-145 · 1 control

  • NISTSP145-1 On-Demand Self-Service and Broad Network Access Characteristics

NIST SP 800-146 · 1 control

NIST SP 800-190 · 1 control

  • NIST190-04 Regulatory compliance for cloud services

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management

New Hampshire Data Privacy Act · 1 control

  • NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties

New Jersey Data Privacy Act · 1 control

  • NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-2 Certification and Accreditation (C&A) for Government Systems

Nigeria Data Protection Regulation (NDPR) · 1 control

  • NGNDPR-8 Annual Data Protection Audit, Penalties, and NDPA Transition

OECD AI Principles · 1 control

  • OECDAI-8 AI Incident Reporting, Regulatory Compliance, Public Reporting, and International Cooperation

OWASP DevSecOps Maturity Model (DSOMM) · 1 control

  • DSOMM-6 Metrics, Maturity Measurement, and Continuous Improvement

Oregon Consumer Privacy Act · 1 control

  • OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring

PDPA Singapore · 1 control

  • PDPASG-7 Retention Limitation, Do Not Call, Compliance, Complaints

PDPA Thailand · 1 control

  • PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training

POPIA · 1 control

  • POPIASA-8 Information Regulator Cooperation, Complaints, Enforcement

Personal Data Act (personopplysningsloven) · 1 control

  • NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training

Privacy Act 2020 · 1 control

  • NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training

Qatar DPL · 1 control

  • QATAR-7 DPO, Records, Retention, Marketing, Training

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-5 Cross-Border Health Data Flows

Saudi Arabia PDPL · 1 control

  • SA-PDPL-25 Compliance monitoring and auditing

South Korea PIPA · 1 control

  • PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2

TCFD Recommendations · 1 control

  • TCFDREC-1 Governance - Board Oversight, Management Role

Taiwan PDPA · 1 control

  • TAIWAN-4 DPIA, Privacy by Design

Texas Data Privacy and Security Act (TDPSA) · 1 control

  • TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

Turkey KVKK · 1 control

  • TURKEYKVKK-3 Special Categories and Sensitive Data

UK AI Regulation Framework · 1 control

  • UKAI-2 Sector-Specific Regulator Engagement

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 1 control

  • HE-3 FSA compliance requirements

Uruguay DPL · 1 control

  • URUGUAY-5 Database Registration with AGESIC URCDP

Vietnam PDPD · 1 control

  • VIETNAMPDP-3 Data Subject Rights

Virginia CDPA · 1 control

  • VIRGINIAVCDPA-4 Privacy Notice and DPIA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Governance, Records and Accountability

Query this from an agent

The graph holds this control, the 78 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) controls