Swiss FADP and GDPR: checks for your website

To review website data protection, start with actual processing: forms, newsletters, analytics, advertising and external tools. Applicable law depends on more than a visitor’s nationality. The Swiss FADP and European GDPR have distinct conditions and obligations; a tool does not automatically ensure compliance.

1. Establish the applicable framework

The FADP protects personal data of natural persons. It applies to circumstances with effects in Switzerland, even when they happen abroad. Its scope is not limited to Swiss citizens. Consult the FADP text for applicability.

The GDPR covers processing in the context of an EU establishment. It can also cover organisations outside the EU offering goods or services to people in the Union or monitoring their behaviour in that context. Mere accessibility from Europe is insufficient. The EDPB guidelines explain the criteria. Multiple regimes can apply to your activities.

2. Inventory data and recipients

For each function, record information collected, purpose, recipients, countries, access and retention. Include browser-loaded tools, support, backups and CRM exchanges. Swiss hosting does not mean every supplier or access location is in Switzerland.

Remove unnecessary fields and limit access by role. Define suitable retention and deletion procedures. Check supplier contracts, subprocessors and transfer safeguards. A server address alone does not establish compliance.

3. Inform people and select suitable mechanisms

Your privacy notice should describe actual practices and remain accessible. The FDPIC explains the duty to inform. Text copied from another website may describe tools, purposes or rights that do not match your activities.

The GDPR provides several legal bases; consent is not required for every processing operation. FADP rules differ and consent is not a universal condition there either. When needed, check validity and scope. For cookies and similar technologies, assess purposes and applicable rules, including with FDPIC resources. Do not label every tracker necessary.

4. Check technical behaviour

Examine what loads before and after visitor choices. Check refusal, acceptance, preference changes and withdrawal when processing relies on consent. A visible banner does not prove scripts respect its choices.

Select tracking and retention settings by needs and obligations. Self-hosting, removing an IP address or using a consent platform does not automatically make processing compliant. Also check forms, exports, logs and administrator access.

5. Prepare requests and incidents

Assign an owner to access, correction and other applicable rights requests. Verify identity proportionately and check the relevant regime’s deadlines. Conditions and exceptions are not identical for every right under both laws.

When a breach occurs, document it and assess notifications. The FADP provides for notification to the FDPIC as soon as possible when the statutory high-risk threshold is likely met. The GDPR provides notably for notification to the competent authority within 72 hours, unless the breach is unlikely to result in a risk to rights and freedoms. Do not automatically apply this deadline to every Swiss situation.

A practical 2027 review

Fictional example: an SME reviews an enquiry form and newsletter registration. It removes an unnecessary field, checks recipients and tests scripts against preferences. The owner updates the notice and prepares an incident procedure. The exercise reduces identified gaps without providing legal certification.

For 2027, assign updates to an owner and trigger a review when tools, purposes or markets change. Retain relevant decisions and evidence. Connect this review with your hosting selection.