GUIDES
Website and data protection: what does an SME website need under the revFADP?
Ben Schmidt, Owner of Flowrenix · Updated:
Short answer
Under the revised Swiss Data Protection Act, in force since September 2023, a website above all needs a privacy policy that honestly describes which personal data it collects, for what purpose, which services receive it and in which countries. On top of that come a notice on cookies and embedded services, a lean contact form and contracts with the providers that process data on your behalf; this article is guidance from my own practice and does not replace legal advice.
First: guidance, not legal advice
I am not a lawyer. I build websites and implement technically what a privacy policy describes: which services are embedded, when they load and where data flows. Here are the points I come across in every project.
For a binding assessment, have your legal texts reviewed by a lawyer. This applies in particular if your website collects sensitive data such as health information, if you are bound by professional secrecy or if your offer is also aimed at customers in the EU.
What changed with the revised Act
The revised Data Protection Act has been in force since 1 September 2023. It now only protects the personal data of natural persons, no longer the data of companies. More important for a website is the extended duty to inform: anyone who collects personal data has to inform the people concerned on their own initiative.
The Act also now requires privacy by design and privacy-friendly default settings. For a website this means: whatever is not necessary is switched off at first. Certain intentional violations can be punished with a fine, primarily against the responsible individuals.
The privacy policy
Almost every business website collects personal data: through a contact form, visitor statistics, a booking or simply through the server's access logs. That is why practically every website needs a privacy policy. It should contain at least:
- who is responsible for the processing, with contact details
- which data the website collects and for what purpose
- which recipients or categories of recipients receive the data, for example hosting, email delivery or statistics
- to which countries data is disclosed and with which safeguards, if those countries do not offer adequate protection
- it is also common to state retention periods and the rights of the people concerned, for example the right of access
The policy has to match the website
The most common mistake is not a missing privacy policy but one that does not match the website. A text from a generator lists services that are not embedded at all and leaves out those that actually run.
So before writing the text I take stock: which fonts, maps, videos, statistics, booking or chat services does the website load, and which data goes to whom? Only this list makes a privacy policy accurate.
Cookies and embedded services
Under Swiss law the basic rule for cookies is that visitors are informed and can refuse the processing. Swiss law does not generally require prior consent for every cookie as is common in the EU. If your website is also aimed at customers in the EU, European law may apply in addition, which usually requires consent for non-essential cookies.
Fonts, maps or videos loaded directly from third-party servers when the page opens pass the visitor's IP address to those providers. There are often simple alternatives: serve fonts yourself, load maps and videos only after a click. How I handle this on this website is described in the cookie policy.
The contact form
The contact form is usually where a website collects the most personal data.
- Only ask for what you need to reply, and mark required fields.
- Transmit the form encrypted via HTTPS.
- Decide where enquiries end up and who has access.
- Decide how long enquiries are kept and delete them afterwards, ideally automatically.
- A newsletter checkbox is never pre-ticked, and third-party spam protection belongs in the privacy policy itself.
Hosting and data location
The Data Protection Act allows personal data to be disclosed abroad if the Federal Council has recognised the country as offering adequate protection. This is the case for the EU member states. For the USA it has applied since 15 September 2024, but only to providers certified under the Swiss-US Data Privacy Framework (see the DPF list). Otherwise safeguards such as contractual clauses are needed. So for ordinary website data the law does not require hosting in Switzerland; with professional secrecy or sector-specific rules this can be different.
A website also consists of several components such as hosting, email sending, forms and statistics, each with its own location. For my own systems I list them individually on the Tech stack page.
Data processors
If a provider processes personal data on your behalf, for example the host, the email service or a form tool, the law calls this processing by a processor. You remain responsible. That is why you need a contract stating that the provider only processes the data as you yourself would be allowed to and protects it appropriately.
Keep a list of these providers. Companies with fewer than 250 employees generally do not have to keep a formal record of processing activities as long as their processing does not involve a high risk; a simple overview still helps when someone requests access.
What I take care of on a website
Legal texts are part of my website projects. I compile the list of embedded services with their locations, set up the cookie notice and forms cleanly and write the privacy policy based on what the website actually does. Accounts with hosting and services are in your name, so the processing contracts are with you as well.
For a binding legal assessment I recommend a review by a lawyer, especially with sensitive data. How I build websites is described on the page Websites with booking.
COMMON QUESTIONS
Frequently asked questions
As a rule, yes. As soon as the website collects personal data, for example through a contact form, visitor statistics or embedded services, visitors have to be informed. That applies to almost every business website.
That depends on which cookies and services your website uses and who it is aimed at. Under Swiss law, information with the option to refuse is generally sufficient. If the website is also aimed at customers in the EU, European law usually requires consent for non-essential cookies.
Not for ordinary website data. The law allows disclosure to countries with adequate protection, which include the EU member states and, since 15 September 2024, certified US providers. Otherwise safeguards are required, and professional secrecy or sector rules may demand more.
A contract with a provider that processes personal data on your behalf, for example a host or email service. It states that the provider only processes and protects the data in line with your instructions. Large providers offer a standard agreement for this.
No. It is guidance from my practice as a developer. For a binding assessment of your legal texts, consult a lawyer.