Data protection in Swiss shops:banners, notices, breach reports.

Which rules apply to a Swiss shop

Two pieces of legislation apply at the same time to a shop based in Switzerland. The Federal Act on Data Protection governs how personal data may be processed. It has been in force since 1 September 2023.^[1] Alongside it stands article 45c of the Telecommunications Act. That provision is not about the data but about reaching the visitor’s device: processing data on third party equipment is permitted only for the telecommunications service itself, or where users are informed about the processing and its purpose and are told that they may refuse it.^[10]

The Federal Data Protection and Information Commissioner states in his guidance that this provision applies cumulatively with the Data Protection Act. Every processing operation on someone else’s device must therefore either serve the transmission or remain controllable by the user, and the form of the information follows the Data Protection Act.^[11]

The key difference from the EU lies in the starting point. Swiss law puts transparency and a right to object first, while Union law as a rule requires prior explicit consent for non essential cookies. The Commissioner says exactly that in his factsheet of 31 March 2026.^[12]

None of this is a free pass. Article 6 requires that data be collected only for a specific purpose that is evident to the data subject, and that processing be proportionate. Article 7 obliges the controller to ensure through suitable default settings that processing is limited to the minimum required for the purpose, unless the data subject decides otherwise.^{[2, 3]}

Information, refusal, consent

The Commissioner’s guidance sorts the use of cookies and comparable techniques into tiers. Which tier applies does not depend on the name of the tool but on how intrusive the processing is.^[11]

Classification follows the FDPIC guidance, version 1.1 of 6 October 2025, section 3.

For the opt out the guidance names three requirements: it must be prominently placed, it must work with few clicks, and the defaults must be privacy friendly. Overriding private interests are to be assumed only with restraint, and analysis for purely statistical purposes is tied to its own conditions, anonymisation above all.^[11]

Where consent is required, article 6 paragraph 6 applies: it is valid only if given voluntarily for one or more specific processing operations and after adequate information. Paragraph 7 requires the explicit form for sensitive personal data and for high risk profiling. High risk profiling exists, on the statutory definition, where data are linked in a way that allows an assessment of essential aspects of a person’s personality.^[2]

With embedded third party services, a video player or a map view for example, those third parties collect data for their own purposes. Operator and third party are then jointly responsible. The operator has to know which services are embedded, has to make sure every duty to inform is met, and has to obtain any consent in a way that names the third parties unambiguously.^[11]

What belongs in the privacy notice

Article 19 sets the minimum content. You must state the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients or categories of recipients to whom personal data are disclosed. Where the data are not collected from the data subject, the categories of data processed are added. Where anything goes abroad, the state and the safeguards or the exception must be named as well.^[1]

On form the Commissioner recommends a layered structure: the essentials on the first level, detail on further levels. The notice must be easy to find and must not be available only on request. In case of doubt, assume that the data are personal data.^[11]

The right of access under article 25 asks for more than the notice. On request you must state, among other things, the personal data as such, the purpose, the retention period or the criteria for it, the available information on the origin of the data, and where applicable the existence of an automated individual decision together with the logic behind it. No one can waive this right in advance, the information is free of charge, and it is provided as a rule within 30 days. If you have a processor handle the data, the duty to answer stays with you.^[6]

A register of processing activities is required of every controller by article 12 in principle. Article 24 of the Data Protection Ordinance exempts companies that employ fewer than 250 people on 1 January of a given year. The exemption falls away where sensitive personal data are processed on a large scale or where high risk profiling takes place.^{[4, 8]}

Anyone who leaves processing to a service provider needs a contractual or statutory basis under article 9 and must satisfy themselves that the processor is able to guarantee data security. Sub processing is permitted only with prior approval.^[5]

Two further duties sit outside data protection law but belong in the same corner of a shop. The Unfair Competition Act requires, in electronic commerce, clear and complete details of identity and contact address including electronic mail, a statement of the technical steps leading to a contract, suitable technical means for spotting and correcting input errors, and immediate electronic confirmation of the order. For email marketing the same article requires prior consent from customers, a correct sender and a straightforward, free way to refuse. Anyone who obtains contact details in the course of a sale, and points out the option to refuse, may send those customers advertising for their own similar goods without consent. Breaches carry, on complaint, a custodial sentence of up to three years or a monetary penalty under article 23.^[17]

Sending data abroad: the country list and the USA

Article 16 allows disclosure abroad where the Federal Council has established that the state concerned guarantees adequate protection. Absent such a decision, suitable protection must be provided by an international treaty, by data protection clauses in a contract that were notified to the Commissioner in advance, by standard data protection clauses the Commissioner has approved, issued or recognised, or by binding corporate rules approved in advance.^[9]

The country list sits in annex 1 to the Data Protection Ordinance. It currently holds 44 entries, among them the states of the European Economic Area as well as Canada, Israel, New Zealand, Uruguay and the United Kingdom.^[13]

The United States are on the list, but with a limit. Adequate protection applies there to personal data processed by organisations certified under the principles of the Swiss-U.S. Data Privacy Framework. The Federal Council recognised that framework on 14 August 2024, and the amendment to the Data Protection Ordinance took effect on 15 September 2024.^{[13, 15]}

For every entry the state and the safeguard belong in the privacy notice, because article 19 paragraph 4 requires it.

When the GDPR applies on top

Under article 3 paragraph 2, the European General Data Protection Regulation also applies to controllers without an establishment in the Union where the processing relates to offering goods or services to data subjects in the Union, irrespective of whether payment is required, or to monitoring their behaviour in the Union.^[16]

For a Swiss shop that means this: as soon as you sell into the EU as a matter of plan, ship there, quote prices in euros or follow visitors from the Union with tracking tools, the Regulation sits on top of the Data Protection Act. Article 27 then requires a representative in the Union in writing, except where processing is occasional, does not include large scale processing of special categories of data and is unlikely to result in a risk. The fine ceiling under article 83 paragraph 5 reaches 20 million euros or four per cent of total worldwide annual turnover, whichever is higher.^[16]

Switzerland mirrors this. Article 14 requires private controllers domiciled abroad to designate a representative in Switzerland where they process data of people in Switzerland in connection with offering goods and services.^[14]

How ordinary cross border trade has become shows in the annual survey by Handelsverband.swiss and NielsenIQ: of 15.8 billion francs of online consumption in 2025, 2.8 billion went to retailers abroad, a rise of eight per cent.^[18]

Data breaches: when you have to report

Article 24 requires a report to the Commissioner as soon as a breach of data security is likely to result in a high risk to the personality or the fundamental rights of the data subject. The report is made as quickly as possible. Swiss law knows no rigid deadline such as the 72 hours of the European Regulation. The processor in turn reports to the controller as quickly as possible. The data subject must be informed where this is necessary for their protection or where the Commissioner requires it.^[19]

What the report must contain sits in article 15 of the Data Protection Ordinance: the nature of the breach, as far as possible the time and duration, as far as possible the categories and approximate number of personal data and of people affected, the consequences including any risks, the measures taken or planned, and a contact person with contact details. Missing details are to be supplied as quickly as possible afterwards.^[20]

Reports go through the Commissioner’s portal. After sending, a confirmation with the reported details can be downloaded. When a high risk is likely to exist is explained in guidance from the Commissioner dated 23 April 2025.^{[21, 22]}

That the route is used shows in the annual report. In the reporting year 2025/26 the Commissioner received more than 2,000 notifications of possible data protection breaches. From those came 22 preliminary clarifications, nine investigations and 156 interventions with controllers.^[23]

How to put this in place

1. Write down the data flows: which data arise at order, payment, shipping, return, account and newsletter, and where they go. That list is the basis for everything else.
2. Settle the register question: below 250 employees the register falls away, as long as no sensitive data are processed on a large scale and no high risk profiling takes place. The data flow list shows whether one of the exceptions bites.^[8]
3. Inventory the scripts: every tool that loads in the front end goes on a list and into one of the three tiers. Anything nobody can explain comes out.
4. Set up the banner: privacy friendly defaults, refuse as reachable as accept, and the choice changeable at any time through a link in the footer.^[11]
5. Write the privacy notice: layered, with the minimum content of article 19 and with the states and safeguards for disclosures abroad.^[1]
6. Bring the contracts up to date: a processing agreement under article 9 for each provider, with sub processing settled.^[5]
7. Rehearse access and reporting: one address for access requests, a process that holds the 30 days, and a reporting route for incidents with a named contact.^[6]
8. Check whether an impact assessment is due: large scale processing of sensitive data or high risk profiling calls for a data protection impact assessment in advance. The Commissioner publishes a factsheet on this.^{[24, 25]}

This article is an orientation and not legal or tax advice; for your own shop a professional review of the specific setup is worth the effort.

Frequently asked questions