Note: This article gives a general overview and does not replace legal advice. For your specific situation, we recommend checking with a specialist.
Who the law affects
The Federal Act on Data Protection (FADP) applies to all private businesses that process personal data — and practically every website does: contact forms, newsletter sign-ups, server log files with IP addresses, or embedded services such as maps and videos. The size of your business makes no difference.
If your offering also targets people in the EU, the European General Data Protection Regulation (GDPR) may apply as well. Many Swiss businesses therefore align themselves with both frameworks.
The privacy policy
At the heart of the revDSG is the duty to inform: anyone who collects personal data must inform the people concerned appropriately. On a website, this is done through a privacy policy that’s easy to find, usually linked in the footer of every page. It must state at least:
- the identity and contact details of the controller,
- the purpose of the processing (e.g. responding to enquiries, sending the newsletter),
- the recipients or categories of recipients, such as hosting providers or analytics services,
- where data is disclosed abroad: the countries involved and the safeguards that apply.
A good privacy policy is specific. It describes the services your website actually uses. Copied template text listing tools you don’t even use creates confusion rather than trust.
Cookies and tracking
Unlike the GDPR, Swiss law has no general requirement to obtain consent before setting cookies. In many cases, it’s enough to inform visitors transparently about cookies and tracking in the privacy policy and to offer a way to object. If you specifically target EU visitors or build extensive profiles, you should still consider a consent banner.
Our recommendation: only use what you actually analyse. Privacy-friendly statistics tools deliver the key figures without building visitor profiles.
Tools and servers abroad
Many website services (fonts, maps, videos, analytics, newsletters) are run from abroad. Disclosing personal data abroad is permitted if the Federal Council has certified the destination country as having an adequate level of data protection (which applies to the EU states, for example), or if suitable safeguards are in place, such as standard contractual clauses. For certified businesses in the USA, the Swiss-U.S. Data Privacy Framework has also applied since September 2024.
In practice, that means: keep a list of every service you embed, check its location and contractual basis, and name it in your privacy policy. Where possible, a Swiss alternative is worth considering, for example for hosting or locally hosted fonts.
Data security
The revDSG requires data security appropriate to the risk. For a website, this includes at least:
- encrypted connections (HTTPS) on every page,
- regular updates to the CMS, plugins and server software,
- backups that can actually be restored,
- strong passwords and, where possible, two-factor authentication for editorial access,
- form data that’s only kept for as long as it’s needed.
If a data security breach nonetheless occurs that is likely to result in a high risk to the people affected, it must be reported as quickly as possible to the Federal Data Protection and Information Commissioner (FDPIC).
Under the new law, fines are directed at the responsible individuals and can reach up to CHF 250,000 for intentional violations — one more reason not to put this off.
Checklist for your website
- Is your privacy policy in place, up to date and linked from every page?
- Are all embedded services (fonts, maps, videos, analytics) listed and described?
- Have data transfers abroad been checked and disclosed?
- Is HTTPS active, is your software up to date, have backups been tested?
- Do your forms ask only for what’s really needed?
- Is there a legal notice with complete company details?
Securely run, in Switzerland
Together with our partner SecureIT Swiss, we host and maintain websites in Switzerland, with updates, backups and monitoring. Get in touch if you’d like us to review your existing website.
