Making your website nFADP-compliant: the checklist for SMEs
Since 1 September 2023, the revised Federal Act on Data Protection (nFADP) applies to every Swiss website that collects personal data, even through a simple contact form. Here is what to check.
A complete privacy policy
As soon as your site collects data, you must inform the people concerned. The policy should state at least:
- who is responsible and how to contact them;
- what data is collected and why;
- who receives it, and if it leaves Switzerland, which countries;
- how long it is kept and how people can exercise their rights.
Forms: ask only for what you need
A contact form only needs a name, an email address and a message. Every extra field should be optional or justified. This is the principle of data protection by design and by default.
Cookies, analytics and third-party services
In Switzerland the nFADP does not require a consent banner for every cookie, but it does require transparency. Every analytics tool, font, map or video embedded from a third party can pass on the visitor's IP address. List them in the policy, or better: serve fonts and images from your own server and drop advertising trackers.
Hosting and transfers abroad
Hosting the site and its data in Switzerland makes everything simpler: there is no transfer abroad to justify. If a provider processes data outside Switzerland, check that the country is on the Federal Council's list of countries with adequate protection, or that contractual safeguards are in place.
Security and data breaches
The law requires security appropriate to the risk: encrypted connection (HTTPS), updates, backups, protected access. If a breach is likely to result in a high risk for the people concerned, it must be reported to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible.
The checklist at a glance
- An up-to-date privacy policy, linked from every page.
- Forms limited to what is needed, with a link to the policy.
- Third-party services listed, or replaced by self-hosted resources.
- Hosting in Switzerland, or justified transfers.
- HTTPS, regular updates and backups.
- Defined retention periods that are actually applied.
This guide is practical help, not legal advice. For a specific case, a review by a specialist is recommended.
Have a project in mind?
The first conversation is free. You then get a fixed price in writing before you commit.
Tell us what you want to create.
Tell us about your idea, even if it is not yet fully defined. No-obligation first conversation.
Or directly
contact@edelmesh.ch