Swiss data protection and web hosting: what the revFADP and GDPR mean for your website, email and backups

Since 1 September 2023 the revised Swiss Federal Act on Data Protection applies: the revFADP, also called nFADP (nLPD in French and Italian, revDSG or nDSG in German). For a small or medium-sized business, one practical question comes up again and again: where may our website, mailboxes and backups be hosted, and what do we need from our hosting provider? The short answer: Swiss law does not require a Swiss data centre, but you must know where your data is, who processes it for you and how it is protected, and you must say so in your privacy policy. This guide explains the rules that matter for hosting, compares them with the EU GDPR and ends with a checklist you can work through.

revFADP, GDPR or both?#

The revFADP applies to companies and private persons in Switzerland that process personal data, meaning any information about an identified or identifiable natural person: names, email addresses, IP addresses, order histories. Since the revision, data about companies is no longer protected by the Act. It also applies to processing abroad when it has an effect in Switzerland.

The GDPR can apply to a Swiss company as well, without any office in the EU: when it offers goods or services to people in the EU, or monitors their behaviour, for example with tracking on its website. A shop that ships to Germany or a hotel that advertises to guests in Italy is quickly in that situation. Then both laws apply side by side, and a company without an EU establishment may also have to name a representative in the EU.

Does my website have to be hosted in Switzerland?#

No. Neither the revFADP nor the GDPR requires an ordinary business website to be hosted in a particular country. What the law regulates is the disclosure of personal data abroad. Switzerland's Federal Council keeps a list of countries with an adequate level of protection, and every EU and EEA state is on it, so hosting in the EU needs no additional transfer safeguards (you still need the processor agreement described below). For the United States, transfers to companies certified under the Swiss-US Data Privacy Framework have been possible since 15 September 2024; for other countries you need safeguards such as standard contractual clauses. In the other direction, the EU recognises Switzerland as a country with adequate protection, a decision the European Commission confirmed in January 2024, so EU customer data can be hosted in Switzerland.

So why do many Swiss SMEs still prefer Swiss hosting? Because it makes things simpler: one country in your privacy policy instead of a list, fewer transfer mechanisms to check, a provider under Swiss law that you can reach in your own language. Some sectors bound by professional secrecy, and some contracts with customers, also set stricter rules on where data may be kept, so check yours before you choose.

Your hosting provider is your processor#

When your host stores your website, the entries of your contact form, your shop orders and your emails, it processes personal data on your behalf: in legal terms it is a processor, and you remain the controller who is responsible for the data. Under the revFADP you may hand processing to a processor by contract, in any form, if it only does what you yourself would be allowed to do and if you make sure it guarantees data security; it may only pass the work on to sub-processors with your prior authorisation. Under the GDPR a written contract, often called a data processing agreement or DPA, is mandatory. A good agreement covers:

• the subject, duration, nature and purpose of the processing and the types of data;
• processing only on your documented instructions, and confidentiality of the staff involved;
• the technical and organisational security measures;
• sub-processors, where they are located and how you are informed about changes;
• support when people exercise their rights or when a data breach occurs;
• deletion or return of the data when the contract ends, and information you can use to check all this.

At ThunderHosting, business customers who process third-party personal data through our services get a data processing agreement on request, as set out in our terms. Our privacy policy lists where we store data and which kinds of providers we work with.

Where your website, email and backups really are#

"Hosted in Switzerland" is rarely one single place. Go through every copy of your data:

• Website and databases. The server that runs your CMS, and the database with form entries, customer accounts and orders.
• Email. Mailboxes often hold more personal data than the website: names, addresses, contracts, sometimes salary or health information. Where your mailboxes are hosted matters as much as where your website is. If you use a separate email service, it is a separate processor with its own location.
• Backups. A backup is a complete copy of your data, often kept in a second data centre. Ask in which country it is stored and how long it is kept: data you delete stays in backups until they rotate out.
• DNS and CDN. DNS records are served from many locations by nature, and a content delivery network copies your pages to servers worldwide. That is usually public content, but list it.
• Third-party scripts. Analytics, web fonts, maps, chat widgets and embedded videos send at least the visitor's IP address to their provider, often in the United States.

With ThunderHosting web hosting, your website, mailboxes and databases run on our Plesk platform in our data centre in Lugano, Ticino. Daily backups are included in every plan. As our privacy policy explains, customer data is stored on servers in Switzerland and the European Union: for redundancy and backups we also use partner data centres in Germany and Finland, in countries that Switzerland recognises as providing adequate protection.

Cookies and analytics#

Swiss law does not have a general cookie consent rule. Under the Telecommunications Act you may store and read data on a visitor's device if you inform them about it and tell them how to refuse, and your privacy policy has to explain what you collect. For visitors in the EU, the GDPR and the EU's ePrivacy rules require prior consent for cookies that are not strictly necessary, such as analytics and marketing. If your website addresses people in the EU, a consent banner that only loads these scripts after consent is the safe choice.

Every tool you add is another recipient, and often a disclosure abroad, that belongs in your privacy policy. Fewer tools mean a shorter policy and a faster site: host web fonts on your own server instead of loading them from a third party, and ask yourself whether you really read the statistics you collect.

Data security: SSL and the basics#

Both laws require technical and organisational measures appropriate to the risk. For a typical SME website that means:

• HTTPS everywhere. Every form, login and shop page must be encrypted. All our web hosting plans include free Let's Encrypt certificates (SSL certificates).
• Updates. Most attacks on websites use outdated CMS versions and plugins. The WordPress Toolkit in the control panel keeps WordPress up to date.
• Separate accounts. Give every person their own FTP or mail account with a strong password instead of sharing one login.
• Backups and restore. Know how often backups run, how long they are kept and how to restore them.
• Data minimisation. Delete old form entries, unused mailboxes and test copies of the website you no longer need.

Attacks on availability are a security topic too: read our article on DDoS protection.

Checklist for Swiss SMEs#

1. List the personal data your website and email process: forms, shop, newsletter, mailboxes, server logs.
2. Ask your host in which country your website, databases, mailboxes and backups are stored.
3. Conclude a data processing agreement with your host and with every other service that processes personal data for you.
4. Check each disclosure abroad: a country on the Federal Council list, or safeguards such as standard contractual clauses or the Data Privacy Framework.
5. Use HTTPS on every domain and subdomain, including webmail.
6. Review cookies and third-party scripts, and use a consent banner if you address visitors in the EU.
7. Update your privacy policy: who you are, what you collect and why, recipients, and the countries data goes to.
8. Define your backups: frequency, location, retention and a restore test.
9. Prepare for a data breach: who decides, and who reports it to the FDPIC (and to an EU authority, where the GDPR applies) within the deadlines.
10. Delete data you no longer need, on a regular basis.

This article is general information, not legal advice. The rules that apply to your company depend on your activity, your customers and your contracts; for your privacy policy and your agreements, ask a specialist. The FDPIC publishes guides for businesses on its website.

Hosting in Lugano with ThunderHosting#

Our web hosting starts at CHF 5 a month with Solo Spark; Smart Space costs CHF 9 and Business Pack CHF 20 a month. Every plan includes mailboxes on your own domain (email accounts and webmail), free SSL, daily backups and the Plesk control panel, and ThunderHosting GmbH is a Swiss company that answers in English, German, French and Italian. If you need your own operating system and root access, a VPS in Lugano gives you full control, and with it full responsibility for securing the server. Moving from another provider? We migrate your website for free. To compare providers on more than data protection, use our checklist for choosing web hosting in Switzerland.

Frequently asked questions#

Is hosting in the EU allowed under the revFADP?#

Yes. All EU and EEA states are on the Federal Council's list of countries with an adequate level of data protection. Mention the countries in your privacy policy.

Do I need a data processing agreement with my hosting provider?#

Where the GDPR applies, yes, it is mandatory. Under the revFADP you must also agree the processing by contract, though no particular form is required; you must make sure your provider processes data only as you would and keeps it secure, and a written agreement is the simplest way to prove it. ThunderHosting provides one to business customers on request.

Does the GDPR apply to my Swiss website?#

It can: if you offer goods or services to people in the EU or monitor their behaviour, for example with tracking. A website for local customers in Switzerland usually falls under the revFADP only.

Do I need a cookie banner in Switzerland?#

For Swiss visitors, informing them and explaining how to refuse cookies is enough. For visitors in the EU, cookies that are not strictly necessary require prior consent.

Where are my emails hosted with ThunderHosting?#

The mailboxes of our web hosting plans run on our Plesk platform in Lugano, together with your website and databases. Backups are kept as described in our privacy policy, including in partner data centres in Germany and Finland.