Data, Privacy and AI risk services

Implementing AI tools such as Microsoft Copilot or other large language model-based systems raises data protection, governance and risk questions that need to be addressed before deployment. Key considerations include: which personal or confidential data the system can access and process, how that data is stored and retained, whether the processing is lawful under GDPR and DSG, what controls prevent misuse or unintended outputs and how decisions made or supported by the AI system are documented and reviewed. Organisations should conduct a data protection impact assessment (DPIA) for high-risk AI deployments and establish an AI governance framework covering accountability, transparency and ongoing monitoring.

A data protection assessment is advisable when an organisation has not reviewed its data processing activities against current GDPR or DSG requirements, when new systems or processes are introduced that involve personal data, when preparing for a regulatory review or audit and when significant changes occur in the business, such as a merger, a new product or expansion into new markets. For high-risk processing activities, a formal data protection impact assessment (DPIA) is a legal requirement under both GDPR and the Swiss DSG.

An external Data Protection Officer acts as the responsible point of contact for all data protection matters, advising the organisation on obligations, monitoring compliance, supporting DPIAs, liaising with supervisory authorities and providing staff guidance. For organisations without a large internal legal or compliance function, an external DPO mandate provides consistent, qualified oversight at a defined scope and cost.

AI governance refers to the policies, processes and controls an organisation puts in place to ensure that AI systems are used responsibly, transparently and in line with applicable laws and ethical standards. As AI tools become embedded in operations, from document processing to customer interactions to internal decision support, the absence of governance creates regulatory, reputational and operational risk. In Switzerland, organisations deploying AI are increasingly expected to demonstrate that their systems are subject to meaningful human oversight and that risks have been assessed and managed.

Compliance with the Swiss DSG and GDPR does not prevent data-driven work - but it does require that personal data is processed with a lawful basis, that individuals' rights are respected and that appropriate technical and organisational measures are in place. Organisations that invest in clear data governance structures, well-documented processing activities and regular compliance reviews can operate with confidence. A structured data protection assessment is typically the starting point for understanding where the gaps are and how to close them efficiently.