Swiss Data Protection Checklist: 10 Points SMEs Should Check

Since 1 September 2023 the revised Swiss Federal Act on Data Protection (FADP, DSG) has been in force. Almost every company website processes personal data: through contact forms, analytics tools, embedded video, or simply the IP address of a page view. This Swiss data protection checklist shows the ten points worth checking on your site, and where the rules differ from the European GDPR.

Note: I am a web developer, not a lawyer. This article is a practical orientation and not legal advice. For sensitive data or a large volume of processing, have a specialist review it.

The FADP in brief

• The FADP now protects natural persons only, not companies.
• IP addresses often count as personal data, because they can be linked to a person. That puts almost every website under the act.
• For most processing the FADP does not require consent. It does require transparency: visitors have to be able to see what happens to their data.
• Intentional breaches, for example of the duty to inform, can mean fines of up to CHF 250,000, aimed at the responsible people rather than, in the first place, the company.

The full text of the act is on Fedlex.

Swiss data protection checklist: 10 points for your website

1. Privacy notice

Under Art. 19 FADP you have to inform people when you collect personal data. A privacy notice should at least cover:

• Name and contact address of the controller
• Which data you process, and for what purpose
• Who receives data, for example hosting, email or an analytics tool
• Which countries data goes to, and with which safeguards (Art. 19 para. 4 FADP)
• Which rights people have, and how they can use them

The notice has to match your site. A copied template that names tools you do not use, or leaves out tools you do use, does not do the job.

2. Imprint

The imprint is not an FADP requirement. It comes from unfair-competition law: anyone offering goods or services online must, under Art. 3 para. 1 lit. s UWG, say clearly who they are and give a contact address including an email. In practice that means company name, legal form, address, email and, where relevant, the commercial-register and VAT numbers.

3. Cookies and tracking

Unlike in the EU, Swiss law does not generally require a prior opt-in for cookies. Under Art. 45c of the Telecommunications Act you do have to inform people about the processing and point out that they can refuse it. A plain notice with a link to the privacy policy is often enough. The simplest path is to skip tracking you do not need, or to use a cookieless analytics tool.

4. Google Fonts, Google Maps and YouTube

If fonts, maps or videos load directly from Google's servers, the browser sends the IP address to Google before the person has clicked anything. A German court treated that, for Google Fonts, as a GDPR breach in 2022. Swiss law is less strict. The clean fix is still simple:

• Host fonts on your own server
• Load maps and videos only after a click (a two-click embed)
• Embed YouTube in privacy-enhanced mode

5. US services

Many analytics, newsletter and form tools store data in the United States. Since 15 September 2024 the Swiss-U.S. Data Privacy Framework has applied: data may go to US companies certified under that framework. You can check certification on the official list. Providers that are not certified need another safeguard, usually standard contractual clauses. Name the United States in the privacy notice either way.

6. Contact forms

Ask only for what you actually need. Name, email and message are usually enough. The form must run over HTTPS, and a short note under the form should link to the privacy notice. Decide how long enquiries are kept, and delete old ones on a schedule.

7. Processors

Hosting providers, email services, agencies or freelancers who can access personal data are processors under Art. 9 FADP. Put the relationship in a contract that covers data protection. With large providers that contract is usually in the terms, or available as a download.

8. Data security

Art. 8 FADP requires appropriate technical and organisational measures. For a website that means, in concrete terms:

• HTTPS on every page
• WordPress, the theme and plugins kept up to date, and unused plugins removed
• Separate user accounts, strong passwords and two-factor authentication
• Regular backups that you have actually tested

9. Report a data breach

If the site is hacked and that is likely to create a high risk for the people affected, Art. 24 FADP says you must report it as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC). Write down who is responsible in an incident, and how you reach your developer or host.

10. Answer access requests

Any person can ask, under Art. 25 FADP, which data you process about them. The answer is generally due within 30 days and is free of charge. If you know where the data sits (form database, mailbox, newsletter tool), you can answer those requests quickly.

Do I need a record of processing activities?

The FADP generally requires a record of all processing. Companies with fewer than 250 employees are exempt, as long as they do not process sensitive personal data on a large scale and do not do high-risk profiling. A simple list of the tools you use is still useful. It helps with the privacy notice and with access requests.

When the GDPR applies as well

The European GDPR can also apply to a Swiss company that deliberately offers goods or services to people in the EU, or monitors their behaviour (Art. 3 para. 2 GDPR). In Basel, with customers from Germany and France, that is common. The stricter rules then apply, including an opt-in for cookies that are not strictly necessary.

Common mistakes on Swiss websites

• A GDPR template from Germany that never mentions Swiss law
• Google Analytics or a Meta pixel with no mention in the privacy notice
• Google Fonts that still load from Google, for example through a plugin, even after a "local" setup
• An imprint with no email address
• Outdated plugins with known security holes

Conclusion

Most points on this Swiss data protection checklist can be checked in an afternoon: a privacy notice that matches the site, a complete imprint, local fonts, tools you chose on purpose, and an install that is kept up to date. A lean example of a privacy notice is on my own site. If you want Google Fonts hosted locally, tracking cleaned up, or a WordPress install tightened, send me a ticket. Agencies can see how that collaboration works under WordPress support for agencies.

Frequently asked questions

Do I need a cookie banner in Switzerland?

Swiss law does not require a banner with prior consent. You do have to inform people about cookies and show them a way to refuse. If the site deliberately targets people in the EU, the GDPR may still require an opt-in.

Does the FADP apply to small companies and sole traders?

Yes. The FADP applies regardless of company size. Relief exists only for individual duties, such as the record of processing activities.

Who is liable for a breach of the FADP?

Fines of up to CHF 250,000 are aimed at the responsible natural persons, for example the owner or a managing director. Only if identifying those people would take disproportionate effort can the company itself be fined up to CHF 50,000 (Art. 64 FADP).

Do I have to host Google Fonts locally?

Swiss law does not explicitly ban Google Fonts. Hosting them yourself is still the cleanest option, because no IP address is sent to Google. It often makes the site faster as well.

What does it cost to bring a website in line with the FADP?

It depends on the starting point. Hosting fonts locally, switching embeds to a two-click pattern and cleaning up plugins often takes one to three hours on a typical WordPress site. The privacy notice itself should be written with a solid generator or a specialist.