First things first: not legal advice
This article gives you a practical overview from the perspective of an agency that builds websites every day. It is no substitute for legal advice. For your specific situation, especially with sensitive data or customers in the EU, it is worth having an expert look into it.
What the nDSG means for websites
The nDSG protects personal data, meaning any information relating to an identified or identifiable person. A website quickly collects such data: through contact forms, newsletter sign-ups and orders, but also through IP addresses, cookies and embedded services.
The core of the law is transparency. Anyone who processes personal data must openly state which data is processed for what purpose, who receives it and in which countries. The principle of collecting only as much data as necessary also applies.
The nDSG applies to everyone who processes personal data in Switzerland, regardless of company size. There are some exemptions for SMEs with fewer than 250 employees, for example regarding the record of processing activities, provided no particularly sensitive data is involved. The duty to inform on the website, however, also applies to small companies.
The privacy policy
Practically every website needs a privacy policy. It must be easy to find, usually via a link in the footer, and explain in plain language what happens to the data.
A template from the internet is a start, but it has to be adapted to your website. It should name exactly the services you actually use and be updated whenever the website changes.
- Who is responsible, with contact details
- Which data is processed for what purpose
- Services used, such as hosting, analytics, newsletter, maps or chatbot
- Who data is passed on to and in which countries
- How long data is kept
- What rights data subjects have, such as access and erasure
Cookies, tracking and embedded services
The nDSG has no general requirement for a cookie banner, as is often familiar from the EU. However, the Telecommunications Act requires you to provide information about cookies and similar technologies and explain how to refuse them. If your website also targets people in the EU, the GDPR with its stricter consent rules may apply.
Services such as Google Analytics, embedded YouTube videos, Google Maps or fonts from external servers transfer data to third parties, sometimes abroad. Check which services are really necessary and mention them in your privacy policy. Data-saving alternatives such as locally hosted fonts or cookie-free analytics reduce the effort.
Forms, newsletters and data transfers abroad
In forms, ask only for what you really need to process the request. Transmission must be encrypted via HTTPS. For newsletters, you need a clear sign-up, ideally with confirmation by email, and an easy way to unsubscribe in every issue.
If data is transferred abroad, for example to cloud services, there must be adequate data protection there or contractual guarantees. This is the case for many European countries. For the USA, the Swiss-U.S. Data Privacy Framework has applied to certified companies since 2024. Ask your providers where they process the data.
Legal notice and other obligations
Anyone offering goods or services online must, under the Unfair Competition Act, provide clear information about their identity: company name, address and a means of contact such as an email address. A legal notice with these details therefore makes sense for practically every company website.
If a data breach occurs with a high risk for those affected, it must be reported to the Federal Data Protection and Information Commissioner. Wilful violations of certain obligations can lead to fines of up to CHF 250,000, which are imposed on the responsible individuals. So it pays to be careful.
Typical weak points on SME websites
When analysing existing websites, we keep coming across the same issues. Often the privacy policy is a template that was never adapted and names services that aren’t even in use, while tools that are actually used are missing.
Also common are fonts, maps or videos that transfer data to third parties without notice when the page loads. Or contact forms that forward enquiries by unencrypted email or ask for unnecessarily many details. Such issues can usually be fixed with little effort.
A third area is old plugins and missing updates. Security gaps can lead to data from forms or the shop falling into the wrong hands. Regular maintenance is therefore not just a technical task, but a data protection one too.
- Privacy policy as an unchecked template
- External services embedded without notice
- Forms with too many mandatory fields
- Outdated plugins and missing updates
- No overview of which data is stored where
Checklist for your website
For new websites, we implement the technical basics in a privacy-friendly way from the start, for example with locally hosted fonts, encrypted forms and data-saving services. If you want to know where your website stands, ask us in the free initial consultation or via the contact form.
- An up-to-date privacy policy tailored to your website
- A complete legal notice with company, address and contact details
- HTTPS on all pages
- Only the necessary fields in forms
- A list of all services used and where they store data
- Information about cookies and a way to refuse them
- With EU customers, also check the GDPR
Frequently asked questions
Does my website need a privacy policy?
As a rule, yes. As soon as personal data is processed, for example through forms, analytics tools or embedded services, you must provide information about it.
Do I need a cookie banner in Switzerland?
The nDSG does not require a general cookie banner. However, you must provide information about cookies and allow people to refuse them. With customers in the EU, stricter rules may apply.
Since when has the new Data Protection Act applied?
Switzerland’s revised Data Protection Act has been in force since 1 September 2023. There was no transition period for existing websites.
