The revised Data Protection Act has applied in Switzerland since 1 September 2023. For a company blog, this means: a clear privacy policy that states which data is collected and where it goes, careful handling of visitor statistics and foreign services, clean consent for the newsletter, and rules for comments and images. A cookie consent banner in the EU style isn't always required, but information and the option to refuse are. Whether your website is additionally covered by the GDPR must be assessed by a specialist.
A company blog collects more data than it might seem at first glance: visitor statistics, newsletter addresses, comments, contact forms, images of people. The revised Data Protection Act, often called the nDSG, has applied in Switzerland since 1 September 2023. This page explains what it means for the typical building blocks of a blog. It doesn't replace legal advice: a specialist is responsible for your specific situation, and you can find the official texts at the FDPIC and on Fedlex.
The main principles of the revised DSG
The new law has brought Swiss rules closer to the European GDPR, without copying it. For website operators, these principles are particularly relevant:
- Transparency: Anyone who collects personal data must inform the people concerned. In practice, this means a privacy policy that clearly states which data is collected for which purpose and who it goes to.
- Purpose limitation and proportionality: Only as much data as necessary, only for the stated purpose.
- Data export: If data is transferred abroad, adequate protection must exist there, or additional safeguards are needed. The FDPIC keeps a list of countries with adequate protection.
- Data security: Technical and organisational measures, such as encryption and access restrictions.
- Privacy by design: Plan data protection in from the start, not add it on afterwards.
Unlike the GDPR, the DSG doesn't impose fines against companies running into millions. Instead, it directs penalties at the responsible individuals. That's a good reason to take the topic seriously at management level.
The privacy policy for the blog
Every website needs a privacy policy, and the blog is part of it. It must fit your website, not a template. Check whether these points are covered:
| Blog component | What belongs in the policy |
|---|---|
| Hosting | Where the website is hosted, which provider, server location |
| Visitor statistics | Which tool, which data, whether cookies are set, storage location |
| Newsletter | Provider, purpose, consent, unsubscribing |
| Comments | Which data is stored (name, email, IP), for how long |
| Contact form | Purpose, storage period, sharing |
| Embedded content | YouTube videos, maps, social media buttons that send data to third parties |
| Blog system or agency | If a service provider writes posts into your website and has access for this |
The last point is often forgotten. An external system that publishes posts via an interface usually doesn't process visitor data, but does have access to your content management system. How the provider handles this access and your company data belongs in the contract.
Visitor statistics: knowing what's counted
Statistics tools are the most common data protection issue on SME websites. Three questions decide it:
- Are cookies set? Swiss telecommunications law requires that visitors are informed about cookies and can decline them. Consent in the EU style isn't always required, but information is. Tools without cookies make this simpler.
- Where is the data stored? If it's stored in the US, the rules on data export apply. The FDPIC provides information on the current situation and recognised safeguards.
- Are IP addresses truncated? A truncated IP address reduces the link to a person. Most tools offer this setting.
The Google Search Console is a special case: it shows which search terms bring visitors, without collecting data on your website. For many blogs, it's enough to measure success. You can find out how to connect it to your blog under Connecting Search Console to the blog.
Newsletter: consent must be active
Promotional emails fall under Switzerland's Unfair Competition Act. Mass emails without consent are not permitted. In practice, double opt-in has become standard: the person signs up, receives a confirmation email and is only added to the list after clicking the link. This way, you can prove consent.
Every email needs three things: a correct sender with address, a note about the option to unsubscribe, and a working unsubscribe link. The law makes an exception for existing customers who provided their address when making a purchase and are offered similar products; even then, unsubscribing must be possible at any time. How the blog technically feeds into the mailing is described on the page Connecting your blog and newsletter.
Comments: little data, clear deadlines
If you allow comments, you store the name, email address and usually the IP address of the commenter. This is permitted if it's stated in the privacy policy and you don't keep the data longer than necessary. Only ask for what you need: a commenter's website address is rarely necessary. Whether comments even make sense for a company blog is covered on the page Should a company blog allow comments?
Images: people and rights
Two areas of law meet when it comes to blog images: data protection law, because a recognisable face is personal data, and copyright law, because photos and graphics belong to someone.
- For employees, customers and guests in photos: obtain and document consent.
- For stock photos: check the licence, keep proof of the licence.
- For AI-generated images: read the service's terms of use, don't let it generate recognisable real people.
Which image sources are suitable for a blog is covered at Images for AI blog posts.
Checklist for your blog
- Is your privacy policy up to date and aligned with your tools?
- Is the analytics tool known, are cookies explained, and is the storage location clarified?
- Does your newsletter use double opt-in and an unsubscribe link?
- Do comments involve minimal data collection and a deletion deadline?
- Are image rights and consents documented?
- Are external service providers with system access contractually regulated?
If you set up these six points properly once, you'll have peace of mind in daily operations. Having a specialist review this is especially worthwhile if you target customers in the EU or process sensitive data, for example in the healthcare or fiduciary sector.
Frequently asked questions
Do I need a cookie banner in Switzerland?
Swiss law requires that visitors are informed about cookies and can decline them, for example through the privacy policy and browser settings. Active consent via a banner, as in the EU, is not required in every case. If you target customers in the EU or are subject to the GDPR, you usually need more. Have this checked by a specialist.
Can I use Google Analytics on a Swiss website?
Using it is possible, but it must be mentioned in the privacy policy, and the transfer abroad must be permitted. The FDPIC provides information on the requirements for data exports. Many SMEs switch to analytics tools that store data in Switzerland or the EU and work without cookies.
Is a pre-ticked box enough for the newsletter?
No. For promotional emails, the Unfair Competition Act requires consent, and a pre-ticked box doesn't count as active consent. Double opt-in with a confirmation email is standard. Every email also needs a working unsubscribe option and the sender with address.
What do I need to consider with photos of employees on the blog?
A recognisable photo is personal data. Obtain consent, ideally in writing, and record what the image will be used for. If a person leaves the company, you should clarify whether the image may remain online. The same applies to customers and passers-by, with even more caution.
Do I need to appoint a data protection officer?
Not for most SMEs. The revised FADP treats appointing a data protection advisor as voluntary; it's only mandatory in special cases. Clarify your specific situation with a specialist if you process large volumes of sensitive data.