Key takeaways
- Three things belong on every Swiss business site: an Impressum, a privacy statement that reflects the data protection act in force since September 2023, and a cookie notice.
- The most common mistakes are not the missing pages. They are Google Fonts loaded from Google, analytics without disclosure, and contact forms that send data nobody mentioned.
- This is practical guidance from a web developer, not legal advice. For anything unusual, ask a lawyer.
The Impressum
Swiss law requires anyone offering goods or services online to identify themselves clearly: name, address, a way to contact you. The rule comes from the unfair competition act and applies to shops in the strict sense, but every Swiss business website has an Impressum in practice, and visitors expect one. A site without it looks like it is hiding something.
What goes in it:
- The business name and legal form (sole proprietorship, GmbH, AG) and the name of the person responsible.
- A postal address, not a PO box alone.
- An email address, and a phone number if you have one for customers.
- The company register and VAT number, if you have them.
Put it in the footer of every page, in German call it Impressum, in English Imprint or Legal notice.
The privacy statement under the nDSG
The revised Swiss data protection act, the nDSG, has been in force since 1 September 2023. Its practical effect on a website: if you process personal data, and a contact form or an analytics tool means you do, you have to tell visitors what you collect, why, where it goes and what rights they have.
A privacy statement for a normal business site covers:
- Who is responsible (you), with contact details.
- What data the site collects: form entries, server logs, analytics, newsletter sign-ups.
- Which tools are involved and where they are hosted. If data leaves Switzerland, which country and on what basis.
- How long data is kept.
- The visitor's rights: information, correction, deletion.
The statement has to match the site. A generator can produce the skeleton, but someone has to check that every tool on the site is actually in it. That check is part of every site I build.
Cookies and the banner question
Swiss law requires you to inform visitors that the site uses cookies and that they can refuse them in their browser. It does not, by itself, require the consent banner you see on EU sites. That banner comes from EU rules, and it applies to you if you deliberately target customers in the EU: prices in euros, delivery to Germany, an EU phone number.
For a Swiss business serving Swiss customers, a clear notice in the privacy statement and a short cookie line is usually enough, provided the site is not loading a pile of tracking scripts. The fewer third-party scripts a site has, the simpler this gets, and the faster the site is. Those two things are not a coincidence.
The mistakes I see most
Google Fonts loaded from Google. Each visit sends the visitor's IP address to Google's servers. The fix is to host the fonts on your own server, which also makes the site faster. Every site I build does this.
Analytics without disclosure. Google Analytics is in use, but the privacy statement does not say so, or does not mention that data goes to the United States. Either disclose it properly or use a privacy-friendly tool hosted in Europe, which I recommend for most small sites.
Forms that do more than they say. A contact form that also adds the address to a newsletter list, or sends a copy to a CRM in another country, without saying so.
Embedded maps and videos. A Google Maps or YouTube embed loads Google's scripts and cookies on your page. A static map image with a link, or a video loaded only on click, avoids that.
A copied privacy statement from another site. It mentions tools you do not use and misses the ones you do. It is worse than none, because it is wrong in writing.
A checklist for your site
- Impressum in the footer, complete and current.
- Privacy statement that names every tool actually on the site.
- Cookie notice, with the option to refuse where consent is needed.
- Fonts hosted locally.
- Analytics either privacy-friendly or properly disclosed.
- Forms that say what happens to the data, and send it over an encrypted connection.
- SSL on the whole site, with the old http address redirecting.
All of this is included in every package I build, because leaving it out to save an hour is a bad trade for the client.
FAQ
Do I need a data protection officer?
Not as a small business in Switzerland. Larger companies and those processing sensitive data at scale have additional obligations, which is where a lawyer comes in.
Does the EU GDPR apply to my Swiss site?
If you offer goods or services to people in the EU, or track their behaviour, parts of it can. A site in German with Swiss prices and Swiss delivery is generally outside it. If in doubt, assume it applies and keep the site lean.
Can I write the privacy statement myself?
You can draft it with a generator. Have someone who knows the site check it against what the site actually does. That is the part generators cannot do.
What are the penalties?
The nDSG provides for fines against the responsible individuals, up to CHF 250'000, for wilful breaches of certain duties. In practice, the bigger risk for a small business is a complaint or a lost customer. Getting the basics right is cheap insurance.
Twenty minutes on the phone, a written quote within two working days.