As soon as a website collects personal data, Swiss data protection law (the revised FADP) requires you to inform visitors: who processes their data, for what purpose, who receives it and in which countries. Visitors must be able to reject non-essential cookies easily, and some uses require express consent. If you sell online, the Unfair Competition Act adds its own duties, and the GDPR may apply as well.
What must a Swiss website tell visitors under the FADP?
The Federal Act on Data Protection (FADP) in its revised form has been in force since 1 September 2023. Its Article 19 requires the controller to inform the data subject appropriately when collecting their data. On a website, this information includes at least:
- the controller's identity and contact details: your company name or your own, an address and an email address;
- the purpose: for example replying to contact form enquiries or measuring the site's audience;
- the recipients, where applicable: the service that delivers the emails, the analytics tool, the host;
- the countries, if data is disclosed abroad, with the safeguards relied on or the exception applied (Art. 19 para. 4).
On its page on the duty to provide information, the Federal Data Protection and Information Commissioner (FDPIC) points out that, unlike the GDPR, the FADP also requires information on the destination state, and advises controllers to check and update their data protection declaration. On a website, that is the privacy policy, linked from every page and from the form.
Timing matters too. According to the FDPIC cookie guidelines (section 3.3.2), visitors must be adequately informed by the time they choose whether to consent to or reject the processing of their data or the use of cookies.
Does a Swiss website need an impressum?
Neither the FADP nor the Unfair Competition Act (UCA) uses the word "impressum". The UCA does set an identification duty in Article 3 paragraph 1 letter s. It applies to anyone who offers goods, works or services online, who must:
- provide clear and complete details of their identity and contact address, including their email address;
- indicate the technical steps that lead to a contract being concluded;
- provide suitable technical means for identifying and correcting input errors before submitting the order;
- confirm the customer's order online without delay.
Points 2 to 4 concern an online ordering process. Paragraph 2 of the same article excludes contracts concluded exclusively by email or comparable individual communication. The text does not say explicitly whether a business website without online ordering is covered.
For a website with a form or audience analytics, the question matters less: Article 19 paragraph 2 letter a FADP already requires the controller's identity and contact details. They belong in the privacy policy, and a legal notice page can repeat them.
Do you need a cookie banner in Switzerland?
On 6 October 2025, the FDPIC adapted its guidelines on cookies and similar technologies (version 1.1). They apply two texts at once: the FADP and Article 45c of the Telecommunications Act (TCA). According to the guidelines (section 2), this article must be complied with alongside the FADP. It permits the processing of data on a visitor's device only for telecommunications services, or if the visitor is informed about the processing and its purpose and told that they may refuse it.
Which cookies need consent?
Not every cookie requires consent. The guidelines distinguish three levels:
- Essential (technically necessary) cookies, which enable the website to work as the visitor requested or meet minimum security requirements (section 3.5.2). The guidelines treat them under the principle of proportionality; only cookies that go beyond what is necessary conflict with it (section 3.6). Default settings must limit processing to the minimum required (Art. 7 para. 3 FADP).
- Non-essential cookies, such as audience analytics or functionality cookies. Where express consent is not required, visitors must be able to reject them, and until they can do so with a button, cookie use must be limited to the minimum necessary (section 3.9). For advertising cookies, visitors must be able to see on their first and later visits how to reject them in a few clicks (section 3.11.2).
- Qualified use: non-essential cookies used with sensitive personal data or for high-risk profiling. The controller must then obtain express consent before processing (section 3.10.1; Art. 6 para. 7 FADP).
Under section 3.9 of the FDPIC guidelines, an SME website that sets analytics cookies must therefore let visitors reject them, and keep cookie use to the minimum necessary until they can do so with a button. Section 3.10.2 sums up these requirements as prominent placement and a clearly displayed option to refuse. A banner that informs without offering a way to refuse does not meet that requirement.
Does the GDPR also apply to a Swiss website?
The GDPR can apply to a business established in Switzerland. Its Article 3(2) sets two criteria for a controller established outside the Union: the processing relates to offering goods or services to people who are in the Union, or to monitoring their behaviour within the Union.
Recital 23 of the same Regulation states that the mere accessibility of a website in the Union is not enough to establish an offer. A language or currency generally used in a Member State, with the possibility of ordering in that language, or mentions of customers in the Union may however show one.
In Geneva, a website that also addresses cross-border customers, or analytics that monitor visitors in France, may therefore fall under the GDPR. If you are planning a website that also targets customers outside Switzerland, raise the question from the start.
Contact forms: what to ask for and where the data goes
A contact form is a processing operation in its own right. Three articles of the FADP set its frame:
- personal data may only be collected for a specific purpose that the data subject can recognise (Art. 6 para. 3), and processing must be proportionate (Art. 6 para. 2);
- default settings limit processing to the minimum required for the purpose (Art. 7 para. 3);
- the privacy policy names the recipients and, if data is disclosed abroad, the countries concerned (Art. 19).
Ask for what you need to reply: a name, an email address and the message may be enough, and the rest can stay optional. Then follow the message: the tool that sends the email, the mailbox that receives it, the website host. Each one is a recipient.
For transfers abroad, Article 16 FADP refers to the list of states whose level of protection the Federal Council has found adequate: Annex 1 of the Data Protection Ordinance (DPO). Germany, where PostHog EU hosts the data of eljadiworks.com, is on the list. The United States is listed only for organisations certified under the Swiss-US Privacy Framework.
According to the eljadiworks.com privacy policy, the site's form goes through Resend, which states in its policy that it may process data in the United States, and then reaches Infomaniak, in Switzerland. These providers depend on the accounts opened for the website: the article on domains and hosting explains how to find out who owns the hosting and the accounts.
Element by element: the rule and what to do
This table works as a checklist for a website that is "FADP compatible", meaning designed with the Swiss Federal Act on Data Protection in mind. Each row links to the relevant passage, consulted on 6 October 2026.
| Website element | Reference text | What to do |
|---|---|---|
| Privacy policy | FADP Art. 19 | Name the controller, purposes, recipients and countries; link the page from every page and the form |
| Identity and contact | FADP Art. 19 para. 2 let. a; UCA Art. 3 para. 1 let. s no. 1 for online offers | Show the name, contact address and email address |
| Online ordering | UCA Art. 3 para. 1 let. s nos. 2 to 4 | Describe the steps, allow input errors to be corrected, confirm the order without delay |
| Essential cookies | FDPIC guidelines section 3.5.2; FADP Art. 7 para. 3 | Limit them to what the function or security requires; describe them in the privacy policy |
| Analytics and non-essential cookies | TCA Art. 45c; guidelines sections 3.9 and 3.10.2 | Inform, then offer a visible way to reject them |
| Sensitive data or high-risk profiling | FADP Art. 6 para. 7; guidelines section 3.10.1 | Obtain express consent before processing |
| Contact form | FADP Art. 6, 7 and 19 | Ask for what is needed, state the purpose, name the recipients |
| Providers abroad | FADP Art. 16 and 19 para. 4; DPO Annex 1 | Name the countries; outside the list, state the safeguards or the exception |
| Visitors in the Union | GDPR Art. 3(2) | Check whether the website offers services in the Union or monitors its visitors' behaviour |
What I check before a site goes live
Before every website goes live, I run the same list:
- the website works, with no bugs or inconsistencies;
- local penetration tests, proportionate to how sensitive the website is;
- FADP/GDPR leak tests: no data or requests sent to an unauthorised server, and consent respected;
- a Lighthouse audit, every time;
- a search for known vulnerabilities in the website's dependencies and their own dependencies;
- publication only when everything is green.
The leak test ties this list to the sections above: the page sends no data or requests to an unauthorised server, and trackers that need consent wait for the visitor's choice. If a website redesign changes its tools, the privacy policy and this test need to be redone.
What these checks do not guarantee
These checks are neither a certified security audit nor a guarantee of legal compliance. This article gives general information and does not replace legal advice. The texts cited become stricter in three cases where a lawyer's opinion is useful: sensitive data or high-risk profiling (Art. 6 para. 7 FADP), selling online (Art. 3 para. 1 let. s UCA), and business aimed at people in the Union (Art. 3 GDPR).
How eljadiworks.com applies these rules
Recorded on 6 October 2026 from the eljadiworks.com privacy policy, updated on 24 September 2026. The banner appears on the first visit, with the refuse button directly above the accept button.
The website works as follows:
- your choice is stored in your browser for 180 days;
- without acceptance, including after refusing or closing the banner, PostHog measures visits without cookies or browser storage and without session recording, using a daily identifier calculated from technical information, including the IP address;
- after acceptance, Google Analytics and PostHog measure browsing with cookies, and PostHog records the session;
- consent can be withdrawn through "Privacy preferences" in the footer;
- the providers named are Cloudflare, Resend, Infomaniak in Switzerland, Google, PostHog EU, which hosts data in Frankfurt, and Sentry when enabled.
The website asks for acceptance before enabling analytics cookies. That goes beyond the minimum described in section 3.9 of the FDPIC guidelines, which requires a way to reject non-essential cookies. It is a configuration choice, and it does not set a general rule. The policy also details processing outside Switzerland and retention periods.
The websites I build follow the same principle: a banner for tools that require consent, trackers that wait for agreement, and a choice that visitors can withdraw. The details are in what I put in place for a website's privacy. The texts, providers, countries and retention periods are defined with each client.
Sources
- Federal Act on Data Protection (FADP), SR 235.1, Articles 6, 7, 16, 19 and 74, as amended on 7 July 2025, consulted on 6 October 2026.
- Data Protection Ordinance (DPO), SR 235.11, Annex 1, status as of 1 December 2025, consulted on 6 October 2026.
- Federal Act on Unfair Competition (UCA), SR 241, Article 3 paragraph 1 letter s and paragraph 2, status as of 1 January 2025, consulted on 6 October 2026.
- Telecommunications Act (TCA), SR 784.10, Article 45c, as amended on 1 June 2026, consulted on 6 October 2026.
- FDPIC, FDPIC guidelines on data processing using cookies and similar technologies, version 1.1 of 6 October 2025 (PDF), sections 2, 3.3.2, 3.5.2, 3.6, 3.9, 3.10.1, 3.10.2 and 3.11.2, consulted on 6 October 2026.
- FDPIC, "Cookie Guidelines: updated version published", consulted on 6 October 2026.
- FDPIC, "Duty to provide information", consulted on 6 October 2026.
- Regulation (EU) 2016/679 (GDPR), Article 3 and recital 23, text checked in the Publications Office of the European Union repository on 6 October 2026.
- Eljadi WORKS, privacy policy, updated on 24 September 2026, consulted on 6 October 2026.
English translations on Fedlex are provided for information only and have no legal force.
