Verified against official sources in Switzerland. ESTV, SECO, AHV-IV, FDPIC, and cantonal portals.
Status: currentKey Numbers
Data Protection in Switzerland (nDSG / FADP), at a glance
Reference
Registration, filing, and key rules
Practical facts for SMEs in Switzerland that need to register, or are already registered.
Watch Out
Mistakes SMEs make most often, Data Protection in Switzerland (nDSG / FADP)
Four issues that authorities flag regularly in audits of small and medium businesses. Most are avoidable with early setup.
FADP fines target individuals, not the company
Unlike GDPR, FADP fines (up to CHF 250,000) are imposed on the responsible natural person, not the company. Naming a clear data-protection lead in your privacy notice + delegating responsibility correctly is essential to avoid personal liability for the CEO or compliance officer.
Privacy notice must be in customer's language
Swiss data subjects must receive a privacy notice in a language they can reasonably understand. For most SMEs that means German, French, and Italian for Swiss customers, plus English for international. A single English-only notice is rarely sufficient.
Processing register is mandatory unless exempt
Article 12 FADP requires a processing register listing all data flows. SMEs with under 250 employees and processing that does not include 'high-risk' personal data may be exempt. Most online businesses (analytics, marketing automation, customer accounts) do not qualify for the exemption.
Cookie consent must precede tracking
FADP + Telecommunications Act require consent before non-essential cookies (analytics, ad pixels) are set. 'Implicit consent on continued browsing' is no longer accepted by Swiss authorities. Use a compliant consent banner before any analytics fires.
Related hubs
By canton or business type
Data Protection in Switzerland (nDSG / FADP) rules are federal, but canton + structure shape how they hit your business.
By canton
By business type