Legal basis analysis

Goal

The legal basis analysis establishes whether a sufficient legal basis covers the solution that a project prepares. In HERMES 2022, the task that produces the analysis serves this purpose: it makes sure "that the legal requirements for the project are met or that the measures are defined in such a way that they can be created".

The technique rests on the principle of legality. Art. 5 para. 1 of the Federal Constitution sets it out: "All activities of the state are based on and limited by law." According to HERMES, the legal basis "must be complied with in every project". HERMES calls it "an immovable restriction". A project can renegotiate a budget or a deadline. It respects a legal basis or has it amended.

The deliverable is the analysis document. HERMES defines its content in seven sections. The Federal Chancellery publishes a Word template that follows them in the same order.

The analysis informs the choice of option and the decision on next steps. The study, that decision and the execution order incorporate its conclusions. The execution order and the phase report each carry a "legal basis" section.

Usage

When to use it

• Project run under HERMES: the analysis is one of the minimum required documents of the initiation phase.
• Solution of a federal body that processes personal data: this processing requires a legal basis (Art. 34 FADP).
• New exchange of personal data: an interface that discloses personal data requires a legal basis that provides for it (Art. 36 FADP).
• New task, new service, new rights or obligations: Art. 164 Cst. reserves their fundamental provisions to federal acts.
• Pilot trial or proof of concept in the federal administration: the FOJ asks projects to state in the analysis whether the test is lawful.
• Service shared between commune, canton and Confederation: HERMES asks the project to examine each level and, where relevant, international law.
• Existing task reinterpreted or expanded: the HERMES template warns that the implementation can exceed what the legal basis provided for.
• Product delivered with the solution: the product compliance section records the product safety and occupational safety rules that the product must meet.

When not to use it

• Scanning the regulatory environment ahead of a strategy: there is no solution yet to check; run a PESTLE analysis.
• Determining the protection needs of information and data: carry out the protection needs analysis.
• Turning an act into criteria that the solution applies: the analysis only says whether the law authorises the solution; formalise the rules with business rules analysis.

Description

The task in HERMES

HERMES 2022 places the task Analyze legal basis in the Project foundations module. It runs in the initiation phase only. It starts at the Project initiation release milestone and draws on the project initiation order and the stakeholder list. HERMES gives it these activities:

• document the existing legal basis with regard to the future system;
• analyse imminent changes to the existing legal basis;
• identify possible gaps in the legal basis and work out proposals to fill them with the competent bodies;
• assess the impact on the study and on project execution;
• coordinate the legal basis analysis with the stakeholders.

The project manager is responsible for the task. HERMES involves the project manager and project support in the outcome. The task carries a rule specific to HERMES: project management makes sure that "the existence of a sufficient legal basis is clarified". To this end it contacts the competent body ("usually legal services or another unit responsible for legislative matters"). If the basis is missing, the project clarifies with these bodies whether and how to amend it.

HERMES does not name the business analyst among the participants. The lawyer still needs what the analyst knows: the functions of each option, their data, their exchanges with other authorities and the people affected. Without the analyst, the analysis risks starting from a description of the solution too vague to test against the law.

The legal aspects of a purchase belong to another task of the module. HERMES assigns them to the procurement analysis, which also chooses the procedure.

A sufficient legal basis

A legal basis exists when a text in force covers what the solution will do. It is sufficient when this text has the legislative level and the precision that the activity requires. The legislative level separates the formal law, which Parliament adopts, from the ordinance, which the Federal Council or another authority issues. A substantive law is any general and abstract rule. An ordinance is one. Art. 164 para. 1 Cst. requires the form of a federal act for "all significant provisions that establish binding legal rules". Its examples include the restriction of constitutional rights, the rights and obligations of persons and the duties of the Confederation. Unless the Constitution prohibits it, a federal act may delegate legislative powers (para. 2).

In an IT project the question arises first for personal data. Under Art. 34 FADP a federal body processes personal data only if there is a legal basis for doing so. Para. 2 requires a formal law for sensitive personal data, for profiling and for processing whose purpose or manner may lead to a serious violation of the data subject's fundamental rights. For sensitive personal data and profiling, an ordinance or another substantive law is sufficient if the processing is essential for a task required by a formal law and if its purpose poses no particular risks to fundamental rights (para. 3). A federal body discloses personal data only on a legal basis in accordance with Art. 34 paras. 1 to 3 (Art. 36 para. 1 FADP). Disclosure therefore follows the same levels. Outside the conditions of para. 3, disclosing sensitive personal data or a profiling result requires a formal law whoever the recipient is.

The FOJ drafting guide on data protection states that cantonal law governs processing by cantonal and communal bodies. It applies even when these bodies enforce federal law or consult a federal database online. A special federal act can derogate from it.

Precision counts as much as the level. According to the same guide, the legal basis must let the data subject know which federal body processes which categories of data for which purpose. The more serious the possible violation of fundamental rights, the more precise the basis must be. An article that gives an office a task without saying which data it processes can therefore suffice for financial aid and fall short for profiling.

The sections of the document

The HERMES template gives each section an instruction and an example. The last two are left open.

The first section sets data protection and IT security aside. Yet the gap example in the same template concerns the legal basis for processing data. The question each one asks separates the two analyses: the legal basis analysis asks whether the law authorises this processing; the protection needs analysis asks which measures protect the data.

Expected changes sometimes create new requirements for the project. The template notes that they often also present an opportunity to close a gap. A revision already in preparation can take in the missing provision without a legislative project of its own. The FOJ memo on pilot trials attaches a condition: the revision must respect the principle of unity of subject matter.

The template compares the law in force and its planned changes with the rough requirements of the study. It also warns that an implementation can reinterpret or expand a task beyond what the basis provided for. It asks the project to detect this case before the missing basis delays deployment.

According to the template, a proposal comprises a standards concept and the project organisation that will lead the amendment. The standards concept names the texts to amend and their main rules. At the FOJ, a directive sets the content of a standards concept. It summarises the normative content in theses and sketches the structure of the act. It proposes the form of the act, its legislative level and its density. It describes the effects on resources and on IT. The memo on pilot trials recommends a standards concept in legislative projects. The FOJ publishes a template for the standards concept (in German).

The HERMES activity gives the subject of the last two sections: the impact on the study and on project execution. For each gap, the assessment of the consequences states which option it affects, which function it removes and which date it moves. The recommendations go to the project sponsor, who decides on next steps.

Running the analysis

1. Describe the solution function by function. For each option in the study, the analyst lists what the authority will do that is new: the decisions, the data processed, the exchanges with other bodies and the people affected. The project initiation order and the rough requirements supply the material.
2. List the existing bases by level. The legal service records the applicable communal, cantonal, federal and international acts. Each entry cites the act, its number in the Classified Compilation and the article.
3. Record the expected changes. The legal service and the unit in charge of legislation report the revisions in preparation, their direction and their planned date of entry into force.
4. Test each function against the law. For each function the team looks for the article that covers it, then checks its legislative level and its precision. A function becomes a gap when no article covers it or when an article covers it at too low a level.
5. Make a proposal for each gap. The competent unit sketches the standards concept. The project names the organisation that will lead the amendment and notes its likely date of entry into force.
6. Assess the consequences. The team compares this date with the schedule of each option. An option that depends on a basis still missing at deployment loses the function concerned or its date slips.
7. Coordinate and obtain approval. The project manager coordinates the analysis with the stakeholders. The document log in the template records the versions, the review and the release.

After the initiation phase, HERMES still lists the analysis among the inputs of the tasks that prepare the solution requirements and the organizational requirements.

Pilot trials

A project that tests a solution before rolling it out remains subject to the principle of legality. The FOJ memo on pilot trials points out that any processing of personal data by the state requires a legal basis at the required legislative level, even in a test. It asks projects to test with fictitious data wherever possible. For a project run under HERMES, the memo asks for the conclusions to go into the legal basis analysis of the initiation phase.

The memo orders its questions from the most general to the most demanding:

1. Does the law in force allow the test, if necessary after an ordinance revision within the margin that the act leaves?
2. Does the field already have rules on pilot trials?
3. Can the Federal Council authorise the processing under Art. 35 FADP?
4. Does the test meet the conditions for a pilot trial under Art. 15 EMBAG?
5. Can a new statutory provision allow the test?

According to the memo, these questions open routes that are in principle independent. As soon as one route provides a sound basis, the memo considers it unnecessary to examine the others. It advises a quick first pass over the five questions in order, then a detailed examination of the promising routes. The project examines the others in detail only if these routes fail.

Before a formal law comes into force, the Federal Council may authorise the automated processing of sensitive personal data, profiling or processing that may seriously violate fundamental rights (Art. 35 FADP). It authorises it if:

• a formal law already in force regulates the tasks that require the processing;
• measures limit the violation of fundamental rights to a minimum;
• for technical reasons in particular, a test phase before the act comes into force is essential for the implementation.

The Federal Council first obtains the opinion of the Federal Data Protection and Information Commissioner (FDPIC). The responsible body submits an evaluation report to the Federal Council no later than two years after the start of the pilot trial. The processing ends if no formal law has come into force within five years of that start.

Art. 15 EMBAG allows a pilot trial linked to a legislative project if seven cumulative conditions are met. Among them, the group of people affected is limited to what is necessary (let. f). All these people must have consented and be able to withdraw their consent at any time (let. g). According to the memo, Art. 15 EMBAG is ruled out as soon as the test cannot obtain the consent of everyone affected. Third parties whose data the test processes count among them. The article reserves Art. 35 FADP. The pilot trial lasts two years at most. It allows a single extension of two years. Its derogations are limited to data protection, information protection and ICT security.

Neighbouring techniques

In a public administration project, the legal basis analysis comes before business rules analysis. Business rules analysis then turns the law into rules that the solution applies.

Pitfalls

Listing without testing. A list of thirty acts that touch the field tells the project sponsor nothing. Only the function-by-function test shows a gap.

Arriving after the option is chosen. The study uses the conclusions of the analysis to evaluate the options. An analysis written after the decision can only justify it.

Judging sufficiency yourself. The legal service judges the legislative level and the precision of a basis. A project manager who decides alone that an article is enough takes a legal decision without the competence to do so.

Forgetting the interfaces. An interface that discloses personal data requires a legal basis at the level that Art. 34 FADP sets (Art. 36 para. 1 FADP). According to the FOJ, it needs a specific basis that states who receives which data for which purpose. The exception in Art. 36 para. 2 covers a specific case. An interface discloses data continuously.

Proposing without a schedule. If a proposal has no likely date of entry into force, the team cannot assess the consequences. The option looks feasible until the day deployment waits for the act.

AI considerations

An AI assistant speeds up the listing. From the description of the options, it proposes a first list of candidate acts and articles for each function. It spots the functions that fall under Art. 34 para. 2 FADP: a health data field or a score that rates people. It drafts the template sections from the legal service's notes and produces the German or French version that the team reviews.

On Fedlex or in the cantonal compilation, the team checks the version of each cited article that applies on the go-live date. A language model can invent a plausible article number or mix up the versions of a revised act. The judgement of sufficiency stays with the legal service: the model does not assess the seriousness of the violation on which the required precision depends. A revision draft that is still internal goes only to an AI service that the organisation has approved for that classification level.

Examples

The analysis of the "Grants Online" portal shows a gap that takes a function away from one option. The team first tests each function of the two options against the law. Gap L1 comes out of the score row.

The project sponsor chooses option B knowing what option A is waiting for from the legislator.

Visualisations

A first diagram shows how a gap arises: the legal service and the team compare the law in force and its changes with the rough requirements of the study. Each gap leads to a proposal, to consequences and then to recommendations. A second diagram gives the legislative level that processing personal data requires under Art. 34 FADP. The template sections, the neighbouring techniques, the test in the example and its analysis are rows and columns, so they are tables.

Cost

Tooling

The HERMES Word template Legal basis analysis can be downloaded from the outcome page on HERMES Online. It contains an introduction, the seven sections with their tables and a document log that records the changes, the review and the release.

Fedlex publishes the Classified Compilation of federal law: each act in its successive consolidated versions with the date from which each one applies. There the analyst checks the text in force on the go-live date. Fedlex also publishes the Federal Gazette and the ongoing consultation procedures: there the legal service and the unit in charge of legislation identify the revisions in preparation.

LexFind (lexfind.ch) brings together federal and cantonal legislation on behalf of the Swiss Conference of State Chancellors. A cantonal or communal project lists the acts of its canton there.

The FOJ publishes its legislative instruments on its Legistische Hauptinstrumente page (in German): the Gesetzgebungsleitfaden (legislative guide), the Gesetzgebungsleitfaden Datenschutz (guide on data protection) with its checklist, the memo on pilot trials and the Muster für Normkonzept (standards concept template).

A spreadsheet links each function of the solution to the article that covers it or to the gap that it opens. The project's requirements management tool can hold this link when the rough requirements are entered in it.

Sources

• Swiss Confederation, Federal Chancellery, HERMES 2022, Project Management reference manual, outcome 4.4.1.44 Legal basis analysis: the description of the outcome and its seven sections. The same manual lists the analysis among the minimum required documents (§4.2.1.1) and in the Project foundations module (§3.4.2.1). In the same manual, the study (task 5.4.3.45), the execution order (task 5.4.3.10, outcome 4.4.1.13) and the phase report (outcome 4.4.1.29) incorporate it.
• Swiss Confederation, Federal Chancellery, HERMES 2022, Project Management reference manual, task 5.4.3.39 Analyze legal basis: the purpose, the immovable restriction, the contact with the competent body, the preconditions, the activities and the roles.
• Swiss Confederation, Federal Chancellery, HERMES template Legal basis analysis (legal-basis-analysis.dotx), downloaded from the outcome page: the instructions and examples for each section.
• Federal Constitution of the Swiss Confederation, SR 101, Art. 5 and 164.
• Federal Act on Data Protection (FADP), SR 235.1, Art. 5, 34, 35 and 36.
• Bundesgesetz über den Einsatz elektronischer Mittel zur Erfüllung von Behördenaufgaben (EMBAG), SR 172.019, Art. 15 (in German; Fedlex publishes no English translation).
• Disability Discrimination Act (DDA), SR 151.3, Art. 14.
• Federal Office of Justice (FOJ), Gesetzgebungsleitfaden Datenschutz, March 2024 (in German): the law applicable to cantonal and communal bodies (section 1.2), the precision that a legal basis for data processing requires (section 3.1.1) and the basis for disclosure (section 3.1.2).
• Federal Office of Justice (FOJ), Pilotversuch, Testbetrieb, Proof of Concept usw. Merkblatt zu Zulässigkeit und Rechtsetzungsbedarf, version 1, September 2026 (in German): the reference to the HERMES legal basis analysis and the recommendation of a standards concept (no. 5), the order of the questions and how to examine them (no. 6), fictitious data, the reading of Art. 15 EMBAG (section 3.4.2) and the revision already in preparation (section 3.5).
• Federal Office of Justice (FOJ), Weisung betreffend die Unterbreitung von Normkonzepten, 24 October 2025 (in German): the content of a standards concept.