nFADP 2026 for SMEs: what your website needs to change
The nFADP (the new Swiss data protection law) came into force on 1 September 2023. Three years later, many SME websites are still not compliant, and compliance involves 6 concrete changes.
Contents
Disclaimer
This article provides general information about the nFADP. It does not constitute legal advice. For complex cases (health, finance, public sector), consult a lawyer who specialises in data protection.
Why the nFADP matters in 2026
The new Swiss Federal Act on Data Protection (nFADP) came into force on 1 September 2023. It replaces the 1992 FADP and modernises the obligations for protecting personal data in Switzerland.
Three years after it came into force, many SMEs in French-speaking Switzerland think it does not concern them (“we only do B2B”, “we just have a business website”). Yet the nFADP applies as soon as a visitor can be identified (contact form, newsletter, tracking, cookie).
Penalties for non-compliance: fines of up to CHF 250,000 for the persons responsible, in serious cases of intentional violation. On top of that come the reputational risk and the loss of customer trust.
This article lists the concrete changes to make to your SME website to be compliant.
Change 1: An explicit privacy policy
Obligation: the nFADP requires a written privacy policy, accessible from every page, that describes:
- What data you collect (email addresses, IP addresses, browsing behaviour)
- Why you collect it (purpose)
- Who you share it with (processors: Google Analytics, Resend, Stripe, etc.)
- How long you keep it
- How users can exercise their rights (access, rectification, erasure)
Who it applies to: every website that collects data, even indirectly (cookie, IP log, contact form).
Typical format: a dedicated page, /privacy/ or /privacy-policy/ depending on your convention, linked from the site-wide footer. A text of 1,500 to 3,000 words that a non-lawyer can read.
Common mistake: copying and pasting a privacy policy found online (often written for France or elsewhere in the EU, not adapted to the Swiss nFADP). Acceptable as a starting point, but it must be adapted to mention the nFADP explicitly, along with the specific processors you use.
Change 2: Cookie banner (if applicable)
What Swiss law says, and how it differs from the GDPR: contrary to a widespread belief, the nFADP does not require you to obtain prior consent before placing a cookie. Prior consent is a European rule (the ePrivacy Directive), absent from Swiss law. In Switzerland, Article 45c(b) of the Telecommunications Act requires you to inform users and give them the option to refuse: an opt-out regime, where the European Union applies opt-in.
Two cases still bring you back to opt-in: if you target visitors from the EU, the GDPR applies to them; and if the cookie serves high-risk processing, consent becomes the safest legal basis again. When in doubt, the banner costs nothing more than a little friction, and it covers both regimes.
Essential cookies (no consent needed): login session, e-commerce basket, language preferences.
Non-essential cookies (consent required): Google Analytics 4, Facebook Pixel, LinkedIn Insight, retargeting ads, heatmaps.
Typical format: a banner visible on the first page load with three buttons: “Accept all”, “Reject all”, “Customise”. Avoid pre-selecting “Accept all” and hiding “Reject” in small print.
Tools: Cookiebot (CHF 9/month), Iubenda (CHF 9/month), Klaro (free, open source), Plausible (no banner needed, anonymous by design).
Plausible does not require consent because it is anonymous by design (no cookies, no fingerprinting). Prefer this type of tool to reduce friction for your users.
Change 3: Notices on the contact form
Obligation: every form that collects data (contact, newsletter, quote) must state:
- What data is collected
- For what purpose
- A link to the privacy policy
- A checkbox for explicit consent (newsletter) or to confirm the policy has been read (contact)
Bad: a form with just “Name / Email / Message / Send”, without any mention of data protection.
Good: a form with a notice under the button, such as “By submitting this form, you agree that your data will be used to reply to you”, followed by a link to your privacy policy, and a checkbox for the newsletter if you offer one.
Change 4: A complete legal notice page
Obligation: an explicit legal notice with:
- Company name and legal form (Sàrl, SA, etc.)
- Address of the registered office
- UID (Swiss business identification number), if registered in the commercial register
- Legal representative
- Contact email
- Telephone
- Identity of the website publisher
Typical format: a /legal-notice/ page accessible from the footer.
Change 5. Processors: DPAs and records
Obligation, with an exception that concerns most SMEs: the nFADP requires a record of processing activities (Art. 12). The Ordinance, however, exempts companies with fewer than 250 employees whose processing poses a limited risk to the personality of the people concerned, which covers the business website of an ordinary SME. The exemption no longer applies as soon as you process sensitive data on a large scale or carry out high-risk profiling.
The record remains good practice even when it is not required: it is what lets you answer an access request without digging around. And the contract with each processor (DPA, or ADV in German) has no exception: it governs what the provider is allowed to do with your data.
Typical processors for an SME website:
- Transactional email (Resend, SendGrid, Brevo)
- Analytics (Plausible, GA4)
- Payment, for e-commerce (Stripe, Datatrans)
- CRM, if applicable (HubSpot, Pipedrive, Salesforce)
- Newsletter (Mailchimp, Brevo, Klaviyo)
Action: get the DPA from each of them (often available directly in their dashboard or on the legal pages of their website) and store it internally. In the event of an audit, you can present it.
Change 6: A procedure for handling requests
Obligation: if a user asks for access to their data or for its deletion, you must respond within 30 days.
Typical procedure:
- An email address mentioned in the privacy policy (“To exercise your rights, contact us at privacy@yoursite.com”)
- An internal procedure to identify the data concerned
- A documented response (export or confirmation of deletion)
For 95% of SMEs, these requests remain rare (1 to 3 a year). But you need to have a procedure ready.
Special cases: sensitive sectors
Health: the nFADP requires enhanced protection for health data. A compliance audit is recommended.
Finance: FINMA regulation on top of the nFADP.
Minors: if you collect data from minors (under 16), parental consent is required.
Public sector: cantonal rules on top of the nFADP. Check with your IT department.
What Voren does for its clients
Every website delivered by Voren includes by default:
- A privacy policy adapted to the nFADP (to be reviewed and personalised by the client)
- A pre-filled legal notice
- A cookie banner if tracking is not anonymous (Cookiebot or an alternative)
- Plausible by default (anonymous, no consent required)
- A documented list of processors
For sensitive sectors, an in-depth compliance audit with a specialist partner lawyer.
Going further
See our Maintenance package: includes regular nFADP checks on Voren websites.
Request a compliance audit: a complete nFADP review of your current website.
