Websites: updates and differences between the Swiss nFADP and the European GDPR
On 1 September 2023 the new Federal Act on Data Protection (nFADP) came into force in Switzerland, replacing the previous act of 1992. The new legislation introduces important changes to the protection of personal data and to compliance obligations, with the aim of ensuring a level of security similar to that of the EU’s GDPR.
Under the new rules, every website that processes the personal data of users located in Switzerland must meet essential requirements on the use of cookies, consent and online tracking.
We will look in detail at what the nFADP introduces, the differences between the Swiss legislation and the European GDPR, and how to bring your website into line once and for all without having to take out a subscription.
An overview of the nFADP: what is it?
The Federal Act on Data Protection (nFADP) sets out the basic principles for processing personal data and strengthens its protection. One of the main aims of the new legislation is to align as closely as possible with the European Union’s General Data Protection Regulation (GDPR), so that personal data can continue to flow freely from the European Economic Area (EEA) to Switzerland.
For websites in particular, where sensitive personal data is processed, the nFADP requires free, informed and voluntary consent from users located in Switzerland, as well as a privacy notice. The nFADP defines personal data as any information relating to an identified or identifiable person, such as visitors’ IP addresses.
As for sensitive data, the nFADP includes information on race, health, religious or political beliefs, genetic and biometric data, social security and the sex life of all users who visit a website. The rules apply to websites in both the private and public sectors and to any portal that processes data of people located in Switzerland, wherever the portal is based in the world. Offenders, that is all non-compliant sites, face heavy fines of up to CHF 250,000.
The main changes introduced by the new act
The new Federal Act on Data Protection (nFADP) brings several changes compared with the previous act. Among the most significant are:
- Privacy by design: technical measures must be taken from the very first planning stage of a web project to ensure data security;
- Stronger consent requirements: the new act pays more attention to making data subjects aware of, and informing them about, the collection and use of their personal data. Businesses must state explicitly on their website the type of data collected, the purposes and more, as well as users’ rights and how to exercise them.
- Easier exercise of data subjects’ rights: users must be able to access and exercise their rights more quickly, asking businesses for information on how their personal data is used in a simple way.
What needs to be done to make a website or online shop compliant with the nFADP and the GDPR?
Clearly, every website and online shop that handles personal information about Swiss users must comply with the new rules.
In practical terms, what measures do you need to take to be compliant?
You need a compliant cookie banner: it must contain clear information on your website’s cookie settings and on how personal data is processed. Like the EU’s GDPR, the Swiss nFADP requires the end user’s consent to cookies to be specific, meaning it must be requested for each type of purpose pursued. A proper consent banner must not have pre-ticked boxes, that is cookies enabled by default, must not push or force users into giving consent, and must not treat actions such as scrolling or continuing to browse the domain as consent. If a visitor refuses a cookie that requires consent, they cannot be denied access to the website.
It is important to provide users with a Privacy Policy and a Cookie Policy, which must include information on the identity and contact details of the controller (your own or a third party’s), on the purposes of the cookies that will be stored and/or read, and on the recipients or categories of recipients of the data.
What are the main differences between the nFADP and the GDPR?
The Swiss nFADP and the European GDPR have some significant differences. While the nFADP is stricter in some respects and asks for less in others, the GDPR is more rigid overall.
One of the main differences is that, unlike the GDPR, the nFADP also penalises individuals and not only companies. In addition, unlike the GDPR, the nFADP does not require a justification for processing personal data.
Another difference concerns the scope. Under Swiss law, the nFADP covers all data processing, both manual and automated, whereas the GDPR applies only to manual data processing.
Furthermore, while the GDPR requires a data protection officer to be appointed, the Swiss nFADP recommends one but does not make it mandatory. Swiss law instead puts the emphasis on involving staff in the data management process, requiring everyone who comes into contact with the data to be informed about the nature of the data, its purpose and how it will be processed.
To comply with data protection laws, it is essential that everyone is fully aware of the risks, obligations and rights connected with data protection.
The main differences between the two sets of rules
| nFADP | GDPR | |
| Information requirements | Less information is required for the privacy policy than under the European rules. It is essential to include the list of countries with which personal data will be shared. | The provisions and minimum requirements for the information to include in the privacy notice are set out in Article 13. |
| Data sharing | The Swiss Federal Council assesses whether the partners with whom data is shared are suitable. Standard contractual clauses of the European Union or other binding corporate rules are taken into account. | The European Commission assesses the suitability of the partners with whom data is shared, taking into account standard contractual clauses or other binding corporate rules. |
| Penalties | Up to CHF 250,000 for the person responsible or up to CHF 50,000 for the company. | For first or less serious infringements, the amount payable will be 2% of total annual turnover or EUR 10 million. |
| Data breach notification | Required “as soon as possible” | Required “within 72 hours” |
| Data protection officer | Recommended | Required |
| Records of processing activities | A list of the countries to which data is disclosed must be included. | Art. 30 GDPR sets out all the information that must be included in the privacy notice. |
| Data protection impact assessments | Where there is a significant risk, you can consult the data protection officer instead of the Federal Data Protection and Information Commissioner (FDPIC). | Where there is a significant risk, the competent supervisory authority must be consulted. |
Why is it essential to bring your website into line with the new nFADP?
It is essential to comply with the new act because only then will every business website be able to ensure that data is processed securely and responsibly.
Today, transparency and trust are a competitive advantage for businesses. Failing to comply and to provide proper protection could seriously damage your brand’s reputation. Another reason not to underestimate is the need to compete on equal terms with the European Union. Only then will it be possible to transfer data internationally and keep doing business in the European market.
Is your website compliant with the new act?
What easy4you can do for your SME
easy4you gives Swiss SMEs practical, hands-on support in adapting to the digital world and to data protection rules. In particular, we can help you with:
An audit of your current situation
We analyse your website and digital processes to check:
- what data you collect and how it is used
- whether your cookies and contact forms comply with the rules
- how user consent is managed
This shows you where you stand now and what is missing for compliance.
Putting the nFADP/GDPR measures in place
Based on the audit, easy4you takes care of:
- updating your privacy notice so that it is consistent with the nFADP and the GDPR
- setting up cookie banners in a compliant way
- handling consent management securely and traceably
Support with technical data protection
We help you:
- introduce multi-factor authentication (MFA)
- set up regular data backups
- secure forms, databases and administrator access
This drastically reduces the risk of breaches and penalties.
Training for your team and staff
easy4you gives Swiss SMEs practical, hands-on support in adapting to the digital world and to data protection rules. In particular, we can help you w
Ongoing monitoring and updates
Rules evolve, and easy4you offers ongoing monitoring services, updating your settings when the rules or best practices change and helping you and your business stay in line at all times.
In short, with easy4you you do not just “get compliant once”: you build a solid, continuous and scalable data protection system.
Conclusion
Data protection is as much a part of your online presence as it is of your company’s reputation. Whether you are collecting email addresses for a newsletter, handling contact forms, tracking activity on your site with cookies or storing customer data, every aspect needs to be managed transparently, securely and in compliance with the nFADP and, where applicable, the GDPR.
Complying means respecting the law and giving visitors and customers reassurance about how you handle their data.
Properly integrating privacy policies, cookie banners and secure technical systems is part of a modern digital strategy. And while the nFADP and the GDPR differ in their requirements and penalties, a common compliance base makes it easier to handle privacy consistently and professionally.
If you are not sure your website is fully compliant, or you want to simplify data management by aligning it with clear, up-to-date best practices, let’s carry out a free check together.
