I've the following scenario. There is a computer system (web application), which let users log data of their work. This data is processed into bills and metrics.
Now a new function should be added, where administrators can act on the behalf of another (less privileged) user. With this new functionality it should be possible to add, edit and delete data in the name of another user.
I did some research about this question, but I don't know where to start. Is it likely that this is handled in a data protection law?
What are the conditions, that such functionality is legal?
The answer should apply for Switzerland or the EU.