When is processing of personal data legitimate, and which principles and technical safeguards apply?

Processing (collecting, storing, analysing, passing on) must be legitimised by a legal basis or a publicly announced purpose. Principles include data minimisation, purpose limitation, transparency and accuracy. Technical safeguards are encryption and anonymisation or pseudonymisation.

Legitimation: every step of data processing needs either

• a legal basis, or
• a purpose that has been made known (purpose limitation announced in advance).

Principles (Swiss DSG, EU GDPR):

• Data minimisation: collect only what the purpose needs.
• Purpose limitation: use the data only for the purpose it was collected for.
• Transparency: the people concerned know their data is being processed.
• Accuracy: the data must be correct.

Technical safeguards:

• Encryption
• Anonymisation / pseudonymisation: anonymised data can no longer be linked to a person. Pseudonymised data replaces the identity with a code that can be reversed with a separate key.

Go deeper:

• Federal Act on Data Protection, FADP (Fedlex, English) — the Swiss principles in the original text.
• Wikipedia: Pseudonymization — how pseudonymisation differs from anonymisation.
• Wikipedia: Data minimization — the principle of collecting only what is needed.