Hosting in Switzerland: choosing and checking a provider

1. The Swiss Legal Framework and Data Protection

Choosing a Swiss host requires checking service, data and responsibilities. The revised FADP protects natural persons; it does not impose local hosting on every private business. Assess location alongside contracts, access, backups and the exit procedure.

Check applicable data and market rules and supplier contracts. Switzerland’s adequacy does not make every processing operation compliant. Breach notification to the FDPIC depends particularly on the high-risk threshold in the FADP. Consult the official FADP text.

2. Digital Sovereignty and the Reach of Foreign Laws

Server location alone does not establish which laws or requests may affect a supplier. Check its group, subprocessors, access locations and encryption key management. Infrastructure in Switzerland does not guarantee immunity from foreign requests.

Ask who can access data and from which countries. Check backups and support tools: their locations or suppliers may differ from the main server. Requirements specific to an administration or sector should not be presented as rules for every SME.

3. Technical Infrastructure and Security Standards

Ask about measures actually implemented: access control, fire protection, power, backups and logs. Check encryption in transit and at rest, permissions and incident procedures. Do not assume every Swiss host offers the same protection.

Certification can help assess a supplier, but check validity, scope and covered services. Distinguish a data centre characteristic from your contract’s availability and restoration commitments. Consult the FDPIC security resources.

4. Performance, Proximity, and Operational Continuity

Proximity can contribute to lower latency, but performance also depends on routing, network, software and load. Measure from users’ locations using actual tasks rather than selecting solely by server address.

Geographic proximity also streamlines contractual relationships and technical support. Working with local teams operating under Swiss law helps align data backup policies, disaster recovery plans, and system maintenance with the organization's actual operational needs.

5. Provider Choice Criteria and Implementation Steps

Selecting a hosting partner requires evaluating several key criteria beyond physical location. Organizations must verify the exact location of primary and backup data, subprocessor transparency, the availability of recent audit reports such as ISAE 3000 Type 2, technical support capabilities, and clear service level agreements.

5.1 Mapping and Qualification of Processing Activities

The first step involves cataloging all processed data and identifying records relating to physical persons under the law. This mapping determines necessary protection requirements and associated confidentiality controls.

5.2 Risk Assessment and Impact Analysis

When proposed processing presents a high risk to individual rights, the organization conducts a data protection impact assessment pursuant to Article 22 of the FADP. This evaluation identifies technical vulnerabilities and determines necessary risk mitigation measures.

5.3 Contractual Validation and Migration

Prior to migration, contractual agreements must specify data ownership, access controls, incident handling, and data return protocols upon contract termination. System migration follows a structured plan with rigorous security and integrity testing.

5.4 Ongoing Monitoring and Planning

For your 2027 plan, assign an owner to security reviews, contract changes and restoration tests. Check access after staff or supplier changes. Review frequency should reflect your organisation’s risks and commitments.

6. Guidance from Specialized Industry Partners

Implementing a secure hosting architecture requires cross-disciplinary expertise in systems engineering, information security, and legal compliance. Partnering with digital agencies and local technical specialists like EWM helps organizations structure IT projects, implement privacy-by-design principles, and select appropriate infrastructure without relying on unfounded claims or artificial guarantees.

An exercise before signing

Fictional example: an SME requests restoration of a test environment and measures time, missing data and the contact procedure. It also checks export for leaving the supplier. Results help compare offers and define commitments; they do not prove a real incident will behave identically.