The revised Federal Act on Data Protection (revFADP) has been in force since September 1, 2023, and applies to practically every company running a website with a contact form, newsletter, or tracking – regardless of company size.
The core duties at a glance
The core duties in brief: a clear, up-to-date privacy policy (duty to inform), proper contractual arrangements with third-party providers such as hosting, analytics or email tools (data processing agreements), and – above a certain size or with particularly sensitive data – a register of processing activities. In the event of a high-risk data breach, there's also a duty to notify the Federal Data Protection and Information Commissioner (FDPIC).
On top of that come data subjects' rights: any website visitor can generally request to know what data is held about them, demand correction of inaccurate data, or request its deletion. Ignoring such requests, or answering them too slowly, is already a breach of a core duty under the law.
What this means for everyday website operation
What's practically relevant for everyday website operation: contact forms should only ask for data that's genuinely needed for the request (purpose limitation), have a sensible retention period, and every tracking or cookie tool needs to be communicated transparently. Swiss hosting isn't mandatory, but it noticeably simplifies assessing data flows abroad.
What's at stake if things go wrong
Unlike the EU GDPR, the revFADP doesn't fine companies directly – for wilful violations it instead holds the responsible individual personally liable under criminal law, with fines of up to CHF 250,000 in serious cases. That's an important difference from the EU rules, but it doesn't change how seriously the core duties should be taken.
International data transfers
When data is passed on to providers abroad – say, an email marketing service or an analytics tool based outside Switzerland – the revFADP requires checking whether the destination country offers an adequate level of data protection. The Federal Council maintains a list of recognised countries; the EU/EEA is generally considered adequate. Where adequacy is lacking, additional contractual safeguards are needed, such as standard contractual clauses.
When a data protection impact assessment is required
A data protection impact assessment is mandatory when a planned processing activity is likely to pose a high risk to the personality or fundamental rights of the people concerned – for example, systematic profiling, large-scale processing of particularly sensitive personal data, or systematic monitoring of publicly accessible areas. For most simple SME websites with a contact form and standard analytics, this usually isn't the case, but a short check at the start of a project creates clarity.
Using cookie banners correctly
The revFADP itself doesn't prescribe a specific cookie banner design, but it does require transparency: visitors must be informed before non-essential cookies (e.g. for marketing or tracking) are set, and must be able to object or consent. Technically necessary cookies, such as for a shopping cart or language setting, don't require consent.
My take: that's exactly why I deliberately host in Switzerland and keep third-party services to a minimum. This overview doesn't replace individual legal advice – for the binding wording of your own privacy policy, I always recommend a review by a qualified professional.
Sandro Geissmann | Geissmann Webconsulting
Sources
All articles are general professional background information and do not replace individual legal or professional advice.