Personal data in Switzerland: what your website must respect

Since 1 September 2023, the revised Swiss Federal Act on Data Protection (FADP) has been in force. It affects any website that collects personal data: contact form, newsletter, visit statistics, customer area. Here is what matters for a small business.

What the revised FADP changes

The law strengthens transparency: people must know who collects their data, why, and who receives it. It also reinforces their rights (access, rectification, deletion) and companies' security obligations.

Six things to check on your website

1. An accessible privacy policy. It states the controller's identity and contact details, the purposes, the recipients and, where relevant, the countries data is transferred to;
2. Lean forms. Ask only for what you need and explain what the information is used for;
3. Cookies and analytics tools. Inform visitors clearly and let them object. If you target visitors in the European Union, the GDPR is stricter (prior consent);
4. Your service providers (hosting, e-mailing, analytics): check where data is stored and frame the relationship with a contract. For transfers to the United States, Switzerland has recognised the Swiss-U.S. Data Privacy Framework since September 2024 for certified companies;
5. Security: HTTPS, regular updates, limited access, backups, strong passwords;
6. People's rights: provide an address and a procedure to answer access or deletion requests (in principle within 30 days).

In case of a data breach

If a data security breach leads to a high risk for the people concerned, it must be reported as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC).

What about penalties?

The FADP provides for fines of up to CHF 250,000. They target, in principle, the responsible individual within the company, for intentional breaches of certain obligations (information, duty to provide access, minimum security…).

Do you need a register of processing activities?

Companies with fewer than 250 employees are in principle exempt, unless they process sensitive data on a large scale or carry out high-risk profiling. That doesn't exempt you from knowing which data you collect and why.

What a privacy policy covers

• The controller's identity and contact details;
• The data processed and the purpose of each processing activity;
• Recipients and processors (hosting, e-mailing, analytics);
• Any transfers of data abroad;
• The retention period;
• Cookies and analytics tools, and how to object;
• People's rights and the contact to exercise them.

A technical checklist for your site

• Site on HTTPS, updated regularly;
• Fonts and resources hosted on your own site rather than loaded from external services;
• A minimal form and a message explaining how the information is used;
• No tracking tool installed without clear information;
• Backups and access limited to what is strictly necessary;
• Contracts with providers who process data for you.

What we provide on your websites

When we build a site, we provide Legal Notice and Privacy Policy pages to be completed with your real information, along with hosting and forms configured with restraint. For legal advice or a compliance audit, we recommend working with a lawyer. A question about your site? Write to us.

Sources and further reading

• Fedlex: Federal Act on Data Protection (FADP)
• FDPIC: Federal Data Protection and Information Commissioner

FAQ