Privacy policy for your website: what the revised FADP requires in Switzerland

The revised Federal Act on Data Protection (revFADP) has applied in Switzerland since 1 September 2023. Anyone who collects personal data through a website, for example via a contact form, an analytics tool, a newsletter or simply the web server log files, must inform visitors about it (Art. 19 FADP). In practice, this is done with a privacy policy that can be reached from every page. It must at least state the controller and their contact details, the purposes of processing, the recipients and, where data is disclosed abroad, the countries and safeguards.

This article is general information and not legal advice. For your specific situation, please consult a data protection law specialist.

What changed with the revised FADP

• The Act (SR 235.1) and the Data Protection Ordinance DPO (SR 235.11) have applied since 1 September 2023.
• Only data of natural persons is protected now, no longer data of companies and other legal entities.
• The duty to inform applies to every collection of personal data. Previously, in the private sector, it only applied to sensitive data and personality profiles.
• Anyone who intentionally breaches the duty to inform can be fined up to CHF 250,000 upon complaint (Art. 60 FADP). The fine is imposed on the responsible person, such as the managing director or the owner.
• Data security breaches likely to result in a high risk for the persons concerned must be reported to the FDPIC as soon as possible (Art. 24 FADP).
• Companies keep a record of processing activities (Art. 12 FADP). Companies with fewer than 250 employees are exempt, unless they process sensitive data on a large scale or carry out high-risk profiling (Art. 24 DPO).

Mandatory information under Art. 19 FADP

Art. 19 requires all information needed for the persons concerned to assert their rights and for processing to be transparent. At a minimum, this includes the following:

Not expressly required by law, but recommended and common in practice: which data you collect in detail, how long you keep it, which rights the persons concerned have (in particular access under Art. 25 FADP, rectification and erasure), which cookies and services you use and how to object, and the date of the last update.

In its guidance on privacy policies on the internet, the FDPIC recommends a layered approach: first a short, easy-to-understand overview, then the details. The policy should be easy to reach from every page, be available in all the languages of the website and avoid vague wording such as "under certain circumstances".

Tip: Your privacy policy must reflect reality. Before you write it, check which services your website actually loads, for example in the browser developer tools under the "Network" tab. Templates are a start, but they do not replace this inventory.

Cookies, analytics and embedded services

The FADP does not require a cookie banner. The relevant provision is Art. 45c of the Telecommunications Act (TCA): anyone who processes data on visitors' devices, for example with cookies, must inform them about the processing and its purpose and point out that they can refuse it. The FDPIC has set out its view in a guide on cookies and similar technologies (version 1.1 of 6 October 2025). The FADP requires express consent for processing sensitive data and for high-risk profiling (Art. 6 para. 7 FADP).

• Technically necessary cookies, for example for the session, shopping cart or language setting: information in the privacy policy is enough.
• Statistics, for example with Matomo or Google Analytics: describe them in the policy, offer a simple way to refuse and state the safeguards for providers abroad.
• Marketing and tracking across several websites, such as advertising pixels and remarketing: according to the FDPIC guide, consent is generally required here.
• Embedded content such as YouTube videos, Google Maps, fonts from third-party servers or social media plugins: they send the IP address to the provider as soon as the page loads. Host fonts locally and load maps or videos only after a click.

Design your banner fairly: refusing must be as easy as accepting, without hidden buttons or pre-ticked boxes. If you have visitors from the EU, the rules there require prior consent for non-essential cookies anyway. Many Swiss websites therefore ask all visitors for consent.

Contact forms, newsletters and server log files

• Contact form: only ask for what you need to reply, and state the purpose and retention period. The form must run over HTTPS. Spam protection such as Google reCAPTCHA transmits data to Google and belongs in the policy.
• Newsletter: have sign-ups confirmed via a confirmation link (double opt-in) so you can prove consent, and offer an unsubscribe option in every issue. Under Art. 3 para. 1 let. o UCA, mass advertising by email generally requires prior consent. Name the mailing service as a recipient.
• Server log files: with every request, the web server stores the IP address, time, page requested and browser, among other things. This serves operation and security and belongs in the policy along with the retention period.
• Online shop and customer account: payment providers, shipping services and accounting software are recipients and must be named.

Hosting providers and other service providers: processing on behalf

Your hosting provider, newsletter service or CRM process personal data on your behalf. Under Art. 9 FADP this is permitted if a contract or the law provides for it, the provider only processes the data as you yourself would be allowed to, and you ensure that the provider guarantees data security. The provider may only engage further sub-processors with your prior authorisation. These rules are often set out in the terms and conditions or in a separate data processing agreement.

If data is disclosed abroad, Art. 16 FADP applies: without further measures, this is possible to countries whose data protection the Federal Council has recognised as adequate. The list is in Annex 1 of the DPO and includes the EU and EEA countries, among others. Other countries require suitable safeguards, usually standard contractual clauses recognised by the FDPIC. For the USA, since 15 September 2024 the Federal Council has recognised companies certified under the Swiss-U.S. Data Privacy Framework. Your privacy policy must name the countries and the respective safeguards.

When the GDPR also applies

Under its Art. 3(2), the EU General Data Protection Regulation also applies to Swiss companies if they specifically offer goods or services to people in the EU or monitor their behaviour, for example with tracking. Signs of a targeted offer include deliveries to the EU, prices in euros or advertising aimed at EU countries. In Liechtenstein, as an EEA state, the GDPR applies directly.

The GDPR requires more information than the FADP, including the legal basis of each processing activity, the retention period, all data subject rights and the right to lodge a complaint with a supervisory authority (Art. 13 GDPR). Depending on the scope, a representative in the EU may also be needed (Art. 27 GDPR).

Tip: Many SMEs write a single privacy policy that covers both the FADP and the GDPR. That way you maintain only one document and are prepared for visitors from the EU as well.

Checklist for your website

1. Inventory: which personal data do you collect, and where? Forms, shop, newsletter, log files, analytics, embedded content, chat.
2. List all external services with the provider's country and check whether that country is on the list in Annex 1 of the DPO or which safeguards apply.
3. Write a privacy policy with the information required by Art. 19 FADP, plus rights, retention and contact.
4. Link it in the footer of every page, in all the languages of the website.
5. Check cookies: allow refusal, and obtain consent for tracking and for EU visitors.
6. Check the data processing agreements with your hosting provider and other service providers.
7. Use HTTPS on the whole website, including all forms.
8. Clarify whether you must keep a record of processing activities.
9. Define procedures for access requests, which generally must be answered within 30 days (Art. 18 DPO), and for data security breaches.
10. Review the policy every year and whenever you add a new service, and update the revision date.

The legal texts are available in the official compilation on fedlex.admin.ch (FADP: SR 235.1, DPO: SR 235.11, TCA: SR 784.10). The FDPIC provides guidance, guides and the reporting portal for data security breaches on edoeb.admin.ch.

At HostOn, processing on your behalf for the data you store in your web hosting, mailboxes and servers is governed by the terms and conditions (section 14). Free SSL certificates for all domains are included in every web hosting package, from Web Hosting Rigi at CHF 11.90 per month incl. VAT, so forms are transmitted encrypted from day one.