A privacy policy under Swiss law must disclose at least three things: who is responsible for the data and how to reach them, for what purpose the data is processed and who it goes to. If data is transferred abroad, the destination country and the protective safeguards are added. That is what Art. 19 of the revised Federal Act on Data Protection (FADP) requires, in force since 1 September 2023. On top of that comes everything data subjects need to exercise their rights. Below you will find which content is mandatory, what belongs in a policy in practice, how to structure it, and where companies based in Germany or the EU must take additional care.
TL;DR
- Mandatory under Art. 19 FADP: identity and contact details of the controller, purpose of processing, recipients or categories of recipients, and for cross-border transfers the destination state and safeguards.
- The FADP also applies to companies abroad where their processing has effects in Switzerland, for instance through an online shop for Swiss customers.
- A template is only enough if it reflects your actual data flows: analytics tools, cloud hosting, CRM, AI features.
- Anyone who intentionally provides incomplete information risks a fine of up to CHF 250,000, imposed personally and not only on the company.
- A properly structured policy can cover FADP and GDPR together, provided the differences are deliberately built in.
Who needs a privacy policy under the FADP
The FADP applies to the processing of personal data by private persons and federal bodies. Personal data means all information relating to an identified or identifiable natural person, so also a business email address such as firstname.lastname@company.ch. Data of legal persons is no longer protected under the revised Act.
Decisive for readers outside Switzerland: under Art. 3 FADP, the Act applies to matters that have effects in Switzerland, even if they are initiated abroad. A Munich online retailer that ships to Switzerland, a Vienna agency with Zurich clients or a SaaS provider with Swiss users will regularly fall under the FADP, alongside the GDPR.
The Federal Data Protection and Information Commissioner (FDPIC) states that companies must draft a privacy policy understandable for users and display it on their website. The duty to inform does not only apply online, however: it covers every collection of personal data, including applications, newsletter sign-ups, customer accounts or employees.
The mandatory content under Art. 19 FADP
Art. 19 FADP requires that the data subject receives all information they need to exercise their rights and to ensure transparent processing. The Act sets out a minimum catalogue:
If the data does not come from the data subject themselves, you must inform them at the latest one month after receipt under Art. 19 para. 5 FADP. If you pass the data on earlier, the time of disclosure applies. The exceptions in Art. 20, for instance where informing is impossible or involves disproportionate effort, are narrow. For an ordinary company with customer contact details they rarely apply.
Unlike the GDPR, the FADP does not require the legal basis for each processing operation to be stated. Those who are also subject to the GDPR name it anyway, because it is required there.
What belongs in a policy in practice
The statutory minimum catalogue is short. But because Art. 19 requires all information data subjects need to exercise their rights, a dependable policy contains more:
Categories of personal data. Even where data is collected directly, an overview helps: master data, communication data, contract data, payment data, technical data such as IP addresses. Data warranting particular protection under Art. 5 lit. c FADP, for instance health data or information on religious views, should be clearly named.
Rights of data subjects. Access (Art. 25), data release and portability (Art. 28), rectification, deletion and objection. State the route: to which address, in which form.
Retention period. The FADP does not literally require it in the policy, but data may only be kept as long as the purpose requires. A statement such as "accounting records ten years, application files until the end of the procedure" builds trust and at the same time satisfies the GDPR.
Cookies and tracking. Which tools you use, for what purpose, who is behind them and how users can object. The FDPIC has published a leaflet on cookies and similar technologies which shows what users should pay attention to, and thereby also what website operators must explain.
Profiling and AI. If you analyse user behaviour, personalise recommendations or process queries with AI services, that belongs in the policy expressly, together with provider and storage location.
Representative in Switzerland. Private controllers based abroad must appoint a representative in Switzerland under the conditions of Art. 14 FADP, for instance where they regularly offer goods or services to Swiss customers on a large scale. The name and address of that representative must be published; the privacy policy is the obvious place.
How to indicate cross-border transfers correctly
For most companies this is the trickiest point. A US newsletter tool, a cloud storage service or a support team in Eastern Europe is already a disclosure abroad. Art. 19 para. 4 FADP then requires the state or international body and, where no adequate protection exists, the safeguards under Art. 16 para. 2 or the exception under Art. 17.
In practice this means: countries with a Federal Council adequacy decision, including the EU states, you can simply name. For other states, state whether standard contractual clauses, binding corporate rules or a certification of the recipient apply. How this works in detail we explain in our article on data transfers to third countries under Swiss law. For US services, the Swiss-US Data Privacy Framework is worth a look: if the provider is certified, that simplifies the disclosures considerably.
Vague wording such as "data may be processed worldwide" is not enough. It does not fulfil the purpose of the Act, because the data subject cannot draw any conclusions from it.
Structure: understandable rather than fully buried
A privacy policy is not a contract that only lawyers read. A layered structure has proven useful:
- Short version at the top: in five to eight lines, who is responsible, which data is processed for what purpose, and how to make contact.
- Breakdown by situations: website visit, contact form, customer account, newsletter, application. That way every reader finds their case.
- Detail level below: individual services, recipients, countries, safeguards, retention periods.
- Rights and contact at the end: a clear route for access and objection.
What such a structure looks like for a specific industry is shown by this example of a clearly structured privacy policy for real-estate agencies: the breakdown by customer situations transfers well to other service providers.
Language matters too. If your offering is aimed at French- or Italian-speaking Swiss customers, at English speakers or at customers from Eastern Europe, the policy should be available in their language. Information the recipient does not understand is not adequate information.
FADP and GDPR in one policy
Many companies in the DACH region fall under both regimes. A joint policy is possible and common, provided it reflects the differences:
In practice this means: the GDPR structure covers much of it, but the list of countries for transfers, the reference to the FDPIC and, where applicable, the Swiss representative must be added. Particularly with CRM systems that have sales and marketing functions, a careful inventory is worthwhile. A good overview of what the GDPR means for customer data in CRM is given in this article; the same questions of purpose, access and storage location arise under the FADP. The remaining duties since the revision are summarised in our article on the revised Swiss Federal Act on Data Protection.
Drafting the policy step by step
- Map data flows. List every point where personal data is generated: forms, shop, cookies, email, phone, accounting, HR.
- Match services and recipients. For each tool: provider, purpose, data categories, server location, contractual basis.
- Check cross-border exposure. For each country outside Switzerland: document adequacy or safeguard.
- Assess risks. Where risk is high, for instance extensive profiling or health data, a data protection impact assessment is required, and its results often also sharpen the policy.
- Write the text. Short version, situations, details, rights. Clear language, no platitudes.
- Reconcile with the technology. A website scan shows whether only the services named actually load.
- Plan for maintenance. Every new tool, every change of provider and every new AI feature triggers an update. State the date of the last change.
Generators deliver a starting text. They do not know, however, which plugin your web designer added later, or that your support team handles enquiries through a ticket system in the US. It is these gaps that count when it matters.
Consequences of breaches
Under Art. 60 FADP, private persons can be fined up to CHF 250,000 on complaint where they intentionally breach the duty to inform under Art. 19 or 21 or provide false and incomplete information. Only intent is punishable; prosecution lies with the cantonal criminal authorities. The fine is in principle imposed on the responsible natural person, for instance the managing director or the responsible employee, not on the company.
The FDPIC itself does not impose fines, but can conduct investigations and order with binding effect that processing be adjusted or stopped. That such decisions hold up is shown by a judgment of the Federal Administrative Court of 22 June 2026, which confirmed an order of the FDPIC against a debt collection company.
Our view: the policy is a mirror of your processes
In our matters we rarely see companies with no privacy policy at all. We see many whose policy has nothing to do with reality: GDPR texts from Germany without Swiss country information, templates that still name a tool switched off long ago but omit the new CRM, or policies in German only for a clientele that mainly speaks English, Ukrainian or Russian.
Precisely in cross-border business the risks lie in the details: data flowing between a Swiss company and partners in the EU or Eastern Europe, processor agreements in several languages, recipients no one has in view anymore. Because we review contracts and privacy texts directly in German, English, French, Ukrainian and Russian, there is no translation step in which meaning is lost. Our advice: do not start with the text, but with the list of your data flows. Once it is complete, the policy almost writes itself.
— Bitblade
Privacy check with Sobiera Legal
You want to know whether your privacy policy stands up to the revised FADP, or do you need a new one for the Swiss market? With our privacy check under the revised FADP we review the policy, data flows and processor agreements and tell you what is missing. An initial consultation with an assessment costs from CHF 150 per hour. All services and conditions are listed under Packages and fees.
Signing privacy contracts electronically: QES or AES?
Alongside the privacy policy, there are often contracts with service providers, such as processor agreements or standard contractual clauses. Many are signed electronically today. Switzerland recognises three levels: the simple (SES), the advanced (AES) and the qualified electronic signature (QES).
Only the QES is treated as equivalent to a handwritten signature in Switzerland and can be used for all legal transactions and submissions to authorities and courts. Unlike the SES and AES, it can be verified with a validator. Technically, this requires a qualified certificate, signature software and a connection to a certified provider.
For most privacy contracts, the law does not prescribe written form, and an AES is then sufficient as a well-provable solution. For international contracts: Swiss and EU law regulate signatures separately. Clarify before signing which law applies to the contract and which signature level your contractual partner recognises.
Frequently asked questions
Is an email address personal data?
Yes, as soon as it can be assigned to an identified or identifiable person. That applies to private addresses and to business ones such as anna.meier@company.ch. General addresses such as info@company.ch are usually not personal data, as long as no person can be identified behind them.
Is my GDPR privacy policy enough for Switzerland?
Often almost, but not entirely. Add the specific destination states for cross-border transfers, the reference to the FDPIC and, where needed, your representative in Switzerland. Also check whether the policy actually reflects your current tools.
How often must I update the privacy policy?
Whenever the processing changes: new tool, new provider, new purpose, new destination country. The FADP does not set a fixed deadline. A review at least once a year and after every website relaunch is sensible in practice.
Does a small company without a website need a privacy policy?
The duty to inform under Art. 19 FADP applies regardless of a website, as soon as you collect personal data. You can then inform in the contract, on the form or by email. A short written policy you refer to is the simplest solution.