Anyone processing personal data in Switzerland must inform the data subjects, and on a website this happens through the privacy policy (also known as a privacy notice). The governing law is the revised Federal Act on Data Protection (FADP), in force since 1 September 2023. It also applies to companies from Germany or other countries as soon as their processing has effects in Switzerland. Below you will read which information must be included, where templates regularly fall short, how to separate FADP and GDPR cleanly in a single document, and what the Federal Data Protection and Information Commissioner (FDPIC) expects on cookies.
TL;DR
- Art. 19 FADP requires every controller, when collecting personal data, to inform at least about identity, contact details, purpose and recipients.
- If data is transferred abroad, the destination states and, where applicable, the safeguards under Art. 16 FADP (such as standard contractual clauses) must be named.
- Foreign companies with Swiss customers fall under the FADP where their processing has effects in Switzerland.
- Intentionally false or incomplete information can be punished with a fine of up to CHF 250,000, imposed on the responsible individual rather than on the company.
- The FDPIC updated its cookie guidance in 2025: where third-party tracking with extensive profiling is used, consent may be required.
Who needs a privacy policy under Swiss law
The duty to inform does not only apply to large groups. It covers every private person and company that collects personal data: the Zurich medical practice with a contact form, the Basel start-up with a newsletter or the Munich online shop that ships to Switzerland. In its leaflet on privacy policies on the internet, the FDPIC makes clear that Swiss companies must draft an understandable policy and make it accessible on their website.
For companies outside Switzerland, Art. 3 is decisive. According to the text of the FADP, the Act applies to matters that have effects in Switzerland, even if they are initiated abroad. A German company that specifically targets Swiss customers, displays prices in Swiss francs or operates a .ch domain should therefore assume that Swiss law applies alongside the GDPR.
On top of that, Art. 14 FADP: private controllers based abroad must, under certain conditions, designate a representative in Switzerland, for instance where they regularly and on a large scale offer goods or services to persons in Switzerland or monitor their behaviour. Where such a representative has been appointed, their name and address belong in the privacy policy.
What Art. 19 FADP requires
The FADP does not provide a fixed model text; it sets out a minimum list. Art. 19 requires all information that data subjects need to exercise their rights and that is necessary to ensure transparent processing. The following overview summarises the mandatory items and how they are typically implemented.
Where data is not obtained directly from the data subject, the information must be provided at the latest one month after the data is received (Art. 19 para. 5). Exceptions are set out in Art. 20, for instance where the person is already informed or where processing is required by law. The exceptions are narrow and never replace a website policy.
In its leaflet on privacy policies, the FDPIC also emphasises form: the policy must be understandable, precise and complete for its target audience. Abstract sentences such as "we process your data to improve our services" are not enough where profiling, retargeting and transfers to advertising networks are hidden behind them. Describe what actually happens, in the language your customers use.
What the FADP does not require, but the GDPR does
Unlike the GDPR, the FADP does not require private controllers to state a legal basis for every processing activity. Processing is generally lawful as long as it complies with the processing principles, and only needs a justification where it infringes personality rights. Companies that are subject only to Swiss law can therefore keep their policy leaner. Those who also serve customers in the EU cannot avoid GDPR items such as legal basis and retention periods.
Cross-border transfers: where templates most often fall short
Almost every website transfers data abroad: cloud hosting, email marketing, analytics tools, video conferencing, CRM. Art. 16 FADP permits this without further conditions only to states that the Federal Council has recognised as providing an adequate level of protection. For all other countries, appropriate safeguards are needed, in practice usually standard contractual clauses recognised by the FDPIC, or one of the exceptions under Art. 17 applies, for example explicit consent.
In the privacy policy you must name the state or the international body and, where applicable, point to the safeguards or the exception used. A blanket phrase such as "data may be processed worldwide" does not meet Art. 19 para. 4. This is exactly where copied templates lack the right clauses, because every tool stack has different destination states.
For US providers, the situation has changed with the Swiss-US Data Privacy Framework: certified companies are regarded as offering adequate protection, non-certified ones are not. What this means for your tools we explain in our article on the Swiss-US Data Privacy Framework. An overview of all transfer options is given in our article on data transfers to third countries: what Switzerland permits.
Cookies and tracking: what the FDPIC expects
On 7 October 2025 the FDPIC published an updated version of its cookie guidance of 22 January 2025. Two points are particularly relevant for website operators:
- Third-party technologies with profiling: where tools are embedded that enable extensive profiling, user consent may be required. This typically concerns advertising pixels and cross-platform tracking.
- Cookie paywalls: models in which users choose between consent and payment are considered possible by the FDPIC in certain circumstances.
For the privacy policy this means: list every tool with its name, purpose, provider and destination state, and the cookie banner must match the policy. A banner that offers only "accept all" without a simple way to decline will hardly meet the transparency requirements.
How seriously the FDPIC takes freedom of choice is shown by the Digitec Galaxus case. Following a formal recommendation, the online retailer reported on 27 November 2025 that customers can now object to personalisation for marketing purposes with a single click. The message to everyone else: a right to object stated in the policy must be just as easy to exercise on the website.
FADP and GDPR in a single document
Many companies from Germany, Austria or Switzerland need both. Instead of two separate texts, a modular structure works well: a common core and clearly marked additional sections for each legal regime.
In practice this means: controller, purposes, recipients and tools are described once. These are followed by a section "Notes for persons in the EU" with legal bases and the right to complain to the EU supervisory authority, and a section for Switzerland with a reference to the FDPIC and the destination states. What the revised Act additionally requires of companies is summarised in our article Revised Federal Act on Data Protection: duties since 2023.
Your own privacy policy in seven steps
- Take stock. List every point where data is generated: contact form, shop, newsletter, applications, customer portal, social media profiles.
- Use the record of processing activities. The record under Art. 12 FADP is the natural basis of the policy. If one of the two documents changes, the other must follow, otherwise contradictions arise that will be noticed at the latest when a data subject request comes in.
- Capture service providers and destination states. For each tool: provider, registered office, server location, contractual basis (processor agreement, standard contractual clauses, certification).
- Formulate purposes concretely. One purpose per data category, without catch-all terms. How understandable privacy notices can look in practice is shown, for example, by the security and privacy handbook for a dispatching tool for security services, which describes data flows in a way users can follow.
- Explain rights and the contact route. How does someone request access, to which address, in which form? Name a channel that is actually monitored.
- Align the cookie banner with the policy. Every tool in the banner must appear in the policy, and vice versa.
- Date and version it. Set a date ("as of October 2026") and review the policy whenever a new tool or service is added, and at least annually.
If you plan new processing with high risk, such as extensive profiling or health data, check beforehand whether a data protection impact assessment is required. Our article on the data protection impact assessment in Switzerland explains the threshold.
Consequences of breaches
The FADP imposes sanctions differently from the GDPR. Under Art. 60 FADP, a fine of up to CHF 250,000 can be imposed on a private person who intentionally breaches the duties to inform under Art. 19 and 21 by providing false or incomplete information. The penalty is imposed on the responsible natural person, for instance the managing director, not on the company. This offence is prosecuted on complaint. Only where identifying the person liable would be disproportionate can the company be fined up to CHF 50,000 under Art. 64. All provisions are set out in the official text of the Data Protection Act.
Negligence is not punishable in relation to the duty to inform. That is no free pass, however: anyone who, after being warned, leaves a visibly incomplete policy in place moves close to intent. If a data protection incident occurs, also check the notification duty towards the FDPIC under Art. 24 FADP.
Our view: a policy that matches the business
In our work we rarely see companies without any privacy policy at all. Far more often we see policies drawn from a generator that have little to do with the actual business. A trading company with partners in Eastern Europe, a founder with a development team abroad, a law firm with clients in several countries: all of them transfer data to states that no template anticipates.
Our approach therefore does not start with the text, but with the data flows. We ask which tools are running, where the data goes and on what basis. Only then do we draft. Because we handle contracts and legal texts directly in German, English, French, Ukrainian and Russian, without external interpreters, we can draft the policy in the languages in which your customers actually read it. That is more than cosmetics: according to the FDPIC, transparency requires understandability for the target audience, and a policy your customers cannot read is not transparent for them.
Our advice: treat the privacy policy like a contract with your customers. It says what you do with their data, and you should be measured by it.
— Bitblade
Privacy check for your website
You want to know whether your policy, your cookie banner and your contracts with service providers stand up to the revised FADP? We offer a privacy check under the revised FADP as well as the review and drafting of the related contracts. An initial consultation with an assessment starts at CHF 150 per hour. All services and fees are listed under Packages and fees.
Frequently asked questions
As a German company, do I need a privacy policy under Swiss law?
If your data processing has effects in Switzerland, for example because you target Swiss customers or ship to them, the FADP applies alongside the GDPR. As a rule, a joint policy with a Switzerland section is sufficient. In addition, check whether you must appoint a representative in Switzerland under Art. 14 FADP.
Is a GDPR-compliant privacy policy enough for Switzerland?
In most cases it covers the bulk, but not everything. The FADP expressly requires that the destination states for cross-border transfers and the safeguards used for them are named. The FDPIC should also be mentioned as the Swiss supervisory authority.
May I use a free template?
A template is a starting point, not a finished product. Art. 19 FADP requires the policy to describe the actual processing, including your specific tools and destination states. Without that adaptation, a template remains incomplete.
Where on the website must the privacy policy appear?
It must be easy to find. The usual place is a link in the footer of every page and near forms where data is collected. The FDPIC requires that the policy is displayed on the website and understandable for users.