Privacy policy for Swiss websites: 5 points SMEs should check

Does your privacy policy still match your website? Five questions help Swiss SMEs with a first check.

When did you last check your privacy policy?

Probably when your website was built. Since then, Google Analytics, a contact form, online appointment booking or other tools may have been added.

This is often where a problem arises, because the website keeps evolving while the privacy policy stays the same.

Especially with older or repeatedly revised websites, companies sometimes no longer know exactly which services are running in the background.

These five questions let you do a first check.

Why data protection also concerns small companies

Since 1 September 2023, the revised Swiss Federal Act on Data Protection (FADP) has been in force. Anyone who collects personal data must, in principle, inform the persons concerned appropriately about the processing.

This does not only apply to large online shops or international companies.

Even a simple contact form can transmit, for example, a name, email address, phone number and other personal details. In addition, external services may process technical data such as the IP address.

A privacy policy is the usual way to inform visitors transparently about which personal data is processed, for what purpose and who is responsible for it.

1. Is your privacy policy easy to find?

Open your website once on a computer and once on a smartphone.

Can you find the privacy policy quickly?

In practice, a clearly visible link in the footer has become standard. What matters is that the information is easy to access.

Tip: don't just check your home page. Visitors can land directly on a blog post, a landing page or another subpage via Google.

2. Are the details still up to date?

Visitors should be able to see which company is responsible for processing their personal data and how it can be contacted.

So check in particular:

Especially after a move, the founding of a company or a change of legal form, such details can quickly become outdated.

• Company name
• Address
• Contact option

3. Does the privacy policy really match your website?

This is one of the most important points.

A template can be a good starting point. What matters is that the privacy policy matches your actual website and the services you use.

So check which features and external services your website really uses.

For example:

Then compare this list with your privacy policy.

Are the relevant data processing activities covered there?

A common mistake: the website is developed further, but the privacy policy stays the same.

• Contact forms
• Google Analytics or other analytics tools
• Meta Pixel or other conversion tracking
• Cookies and similar tracking technologies
• Google Maps
• YouTube or Vimeo
• Calendly or other booking systems
• Mailchimp or other newsletter services
• Social media plugins
• Chatbots or AI features
• other external plugins and integrations

4. Is it clear what happens to the data?

Visitors should be able to understand which personal data is processed, what it is used for and who receives it, if applicable.

This includes, for example, contact details from a form or technical usage data from analytics tools.

If data is transferred to external providers or abroad, additional information may be required. Which details are actually needed depends on the specific data processing.

A good test question is therefore: does a visitor understand what happens to their data?

5. Was the privacy policy reviewed after changes?

A website is rarely ever truly finished.

Perhaps you'll later add a newsletter, online appointment booking, Google Analytics, a Meta Pixel or an AI chatbot.

This can change which data is processed and which external providers have access to it.

A simple example: a hair salon adds an external online booking tool. Additional customer data is then processed by an external provider, so the existing privacy policy should be reviewed accordingly.

That's why the privacy policy also belongs on the checklist whenever the website changes significantly.

Website creation

Can data protection breaches lead to fines?

Yes. The Swiss Data Protection Act provides for fines of up to CHF 250,000 for certain intentional breaches of duty.

However, this does not mean that every mistake on a website automatically leads to a fine. The CHF 250,000 is the statutory maximum penalty for certain intentional breaches.

Under the penal provisions of the FADP, it is primarily natural persons who are fined.

Nevertheless, companies should take their duty to inform seriously and review their privacy policy regularly.

Your quick check

Before you click on, quickly check:

If you can't tick every box, it's worth taking a closer look.

• ✓ Privacy policy easy to find
• ✓ Company and contact details up to date
• ✓ Tools and external services in use are covered
• ✓ Data processing described clearly
• ✓ Reviewed again after changes to the website

Do you know which tools are active on your website?

Especially with older or repeatedly revised websites, it's often no longer clear which tracking tools, plugins and external services are running in the background.

Visiup analyses your website technically and shows you which external services, tracking tools and integrations are embedded.

This gives you a better overview of what actually happens technically on your website and where action may be needed.

Visiup does not provide legal advice. For a legal assessment of your privacy policy, you should consult a suitably qualified professional if necessary.

Have your website checked →