What the revFADP changed
The revised Federal Act on Data Protection came into force on 1 September 2023. It now protects only the data of natural persons and requires more transparency: anyone who collects personal data must actively inform the people concerned.
Personal data means any information relating to an identified or identifiable natural person. This includes the name and email address in a contact form and, depending on the circumstances, IP addresses transmitted when a page loads.
When you need a privacy policy
You need a privacy policy as soon as your website processes personal data. That applies to almost every business website: contact form, newsletter sign-up, web analytics, customer account or shop.
The policy must be easy to find, usually through a link in the footer of every page. Provide it in every language your website uses to address customers.
What your privacy policy must include
As a minimum, state who is responsible (the controller), with business name and contact details, the purposes for which you process data, and the recipients or categories of recipients you disclose data to, such as hosting providers, newsletter services or payment providers.
If you disclose data abroad, name the countries and, if they do not provide adequate data protection, the guarantees you rely on. Also explain the rights of the people concerned, in particular their right to request information, correction and deletion, and how they can exercise these rights.
Fines and responsibility
For wilful breaches of certain duties, such as the duty to inform people when collecting their data or to answer their requests for information, the revFADP provides for fines of up to CHF 250,000. Unlike in the EU, these fines are imposed mainly on the responsible individuals within the company, not on the company itself.
If a breach of data security is likely to lead to a high risk for the people concerned, you must also report it to the Federal Data Protection and Information Commissioner (FDPIC) as quickly as possible.
A checklist for your website
Forms: only ask for data you really need, and transmit it encrypted via HTTPS. Analytics tools: check which data is collected, whether IP addresses are truncated and where the provider stores the data.
Embedded content: Google Maps, YouTube videos and externally loaded fonts such as Google Fonts send data to third parties as soon as a page opens. You can host fonts on your own server and set maps and videos to load only after a click.
Hosting location and contracts: find out in which country your website and your form data are stored. If a service provider processes data on your behalf, such as your hosting, newsletter or CRM provider, set out the terms of this processing in a contract.
Frequently asked questions
Does the revFADP also apply to small websites?
Yes, the law sets no minimum size. As soon as your website processes personal data, for example through a contact form, the duty to provide information applies. The relief for SMEs mainly concerns internal documentation.
Does my SME have to keep a record of processing activities?
Companies with fewer than 250 employees are generally exempt. The exemption does not apply if you process large volumes of sensitive personal data or carry out high-risk profiling. A simple record still helps you keep track.
Do I need a data protection officer?
For private companies, appointing a data protection officer is voluntary. The officer can be internal or external and helps with questions and training. For many SMEs, it is enough to make one person in the company responsible for the topic.