The revised Federal Act on Data Protection (revFADP) has been in force since September 1, 2023, and applies to practically every company running a website with a contact form, newsletter, or tracking – regardless of company size.
The core duties in brief: a clear, up-to-date privacy policy (duty to inform), proper contractual arrangements with third-party providers such as hosting, analytics or email tools (data processing agreements), and – above a certain size or with particularly sensitive data – a register of processing activities. In the event of a high-risk data breach, there's also a duty to report it.
What's practically relevant for everyday website operation: contact forms should only ask for data that's genuinely needed for the request (purpose limitation), have a sensible retention period, and every tracking or cookie tool needs to be communicated transparently. Swiss hosting isn't mandatory, but it noticeably simplifies assessing data flows abroad.
Our take: that's exactly why we deliberately host in Switzerland and keep third-party services to a minimum. This overview doesn't replace individual legal advice – for the binding wording of your own privacy policy, we always recommend a review by a qualified professional.
Sandro Geissmann | Geissmann Webconsulting
All articles are general professional background information and do not replace individual legal or professional advice.