Contact
What are you interested in?
Swiss Data Protection Act (FADP / DSG).
The Federal Act on Data Protection (FADP, German: Datenschutzgesetz, DSG) governs how companies and federal bodies in Switzerland may process personal data. The revised version (revDSG) has applied since 1 September 2023 and requires, among other things, a privacy policy, data security and the reporting of serious data breaches.
Swiss Data Protection Act (FADP / DSG) — Explained in Detail
The DSG protects personal data, meaning any information relating to an identified or identifiable natural person — name, email, phone number, but also IP addresses or device identifiers if they can be linked to a person. Since the revision, the law protects only natural persons, no longer companies. For businesses, the principles of lawfulness, transparency, purpose limitation, proportionality and data security apply.
Four obligations matter most for websites. First, the duty to inform: anyone collecting personal data must say so, typically in a privacy policy — which data, for what purpose, to whom it is disclosed and to which countries. Second, data security: appropriate technical and organisational measures, such as HTTPS, access control and backups. Third, data protection by design and by default (privacy by design and by default). Fourth, reporting data security breaches to the Federal Data Protection and Information Commissioner (FDPIC, German: EDÖB) where there is a high risk for the people affected.
With service providers such as hosting, newsletter tools or CRM, the rule is: if you have data processed on your behalf, you remain responsible and need a data processing agreement. Disclosures abroad are permitted to countries with an adequate level of data protection — which includes the EU member states. For the USA, since 15 September 2024 an adequate level applies only to companies certified under the Swiss-U.S. Data Privacy Framework; for other recipients, additional safeguards are needed, such as standard contractual clauses. The DSG does not require servers to be located in Switzerland.
New are personal fines of up to CHF 250,000, aimed at the responsible natural persons, for example for wilful breaches of the duty to inform. This has moved the topic up the agenda in many management teams. In practice it does not mean overloading every website with legal text, but knowing which data is processed where, and disclosing that honestly. This entry explains a term; it is not legal advice.
A DSG check for your own website
Which forms are there, and where does the data go? Which external services are embedded — analytics, maps, videos, fonts, chat, newsletter? Where are their servers, and are there data processing agreements in place? Does the website run entirely over HTTPS? Is there an up-to-date privacy policy that describes exactly these points? And who is responsible internally when someone asks for information about their data?
Example: form, newsletter and statistics
A gym collects trial-session requests through its website, sends a newsletter via a US provider and measures visits with Google Analytics. Under the DSG this means: the privacy policy names all three processing activities, the recipients and the countries; there is a data processing agreement with the newsletter provider, with safeguards for the transfer to the USA; and enquiry data is deleted after a defined period. Switching to cookie-free statistics simplifies the picture further.
We clarify privacy-friendly technology, choice of hosting and embedded services for every new website. More on the location question can be found in a German-language article in our magazine on DSG-compliant hosting in Switzerland.
Related Page
Web Development ZurichIn-depth on the blog
Datenschutz als WettbewerbsvorteilFrequently Asked Questions About Swiss Data Protection Act (FADP / DSG)
The revised Data Protection Act (revDSG) has been in force since 1 September 2023, together with the new Data Protection Ordinance (DSV). A transitional period for existing processing applied only to a few points.
As soon as a website processes personal data — for example through a contact form, server logs with IP addresses, analytics tools or embedded services — there is a duty to inform. That applies to practically every company website.
The DSG is the Swiss law, the GDPR (German: DSGVO) the EU regulation. They pursue similar aims but differ in details such as consent requirements, fines and documentation duties. Anyone who deliberately targets people in the EU may additionally fall under the GDPR.
No. The DSG does not require a Swiss server location. Hosting in the EU is permitted; with US providers it depends on whether they are certified under the Swiss-U.S. Data Privacy Framework — otherwise additional safeguards are needed. What matters is a data processing agreement and appropriate security.
More Terms Starting with "D"
Domain Authority
Domain Authority (DA) is a metric developed by Moz (0–100) that predicts the 'strength' of a domain....
Design System
A Design System is a collection of reusable UI components, design tokens, guidelines, and documentat...
Digital Accessibility
Digital accessibility (web accessibility) ensures that websites and apps can be used by everyone — i...
Ready for Your Project?
Apply this knowledge to your website — DLM Digital will help you.