Home › Guide › Imprint & Privacy

Imprint and privacy policy: What your website needs

Two pages that nobody likes to write – and yet almost every business website needs them. What the law requires, what is merely recommended, and what you should keep in mind.

By Gabriel Bosnjak · As of October 11, 2026 · 5 min read

The Imprint

In Switzerland, the imprint requirement is set out in the Federal Act Against Unfair Competition (UWG, Art. 3 Abs. 1 Bst. s). According to SECO, anyone who offers goods, works or services in electronic commerce must:

• provide clear and complete information about their identity and provide a contact address with email,
• point out the individual technical steps that lead to the contract,
• provide means to identify and correct input errors before ordering,
• electronically confirm the order without delay.

The last three points concern the ordering process of a shop. For the imprint itself, the first one counts. In practice, it should include:

• the name of your company as it appears in the commercial register – for a sole proprietorship without registration, your first and last name,
• a postal address with street and city,
• an email address through which you can be reached,
• useful, but not explicitly required: phone number, UID number (CHE-...) and the responsible person.

Online shops, online bookings and order forms clearly fall under this requirement. Whether a website that only presents its services already falls under it is judged differently. An imprint costs nothing and builds trust – we recommend it for every business website.

The Privacy Policy

Since September 1, 2023, the revised Data Protection Act (DSG) has been in effect. Anyone who collects personal data must inform the affected persons (Art. 19 DSG) – for all personal data, no longer just for particularly sensitive data. On a website, this almost always happens:

• via a contact form or enquiry by email,
• via a newsletter, appointment booking or customer account,
• via visitor statistics, embedded maps or videos and advertising pixels,
• via the server logs that every website maintains.

At minimum, you must disclose (Art. 19 Abs. 2 and 4 DSG):

• who is responsible and how to reach you – identity and contact details,
• what you use the data for,
• who you share data with – at least the categories, such as hosting, newsletter service or payment provider,
• which countries data goes to if it goes abroad, and what guarantees you rely on.

The Federal KMU portal additionally recommends naming the rights of users (such as access and objection), a contact person for data protection matters and security measures. The statement should be clearly visible – a link in the footer of every page is customary.

Cookies and Tracking

Unlike in the EU, Swiss law does not generally require consent for cookies. Under the Telecommunications Act (Art. 45c FMG), you must provide information about cookies and their purpose and indicate how to reject them. The Federal Data Protection and Information Commissioner (FDPIC) clarified this in his guide from January 2025, supplemented in October 2025, as follows:

• Technically necessary cookies – shopping cart, login, language selection, the saved cookie choice – are permitted.
• For other cookies, information and an easily accessible option to decline are generally sufficient. Until then, only as few cookies as necessary should be set.
• An explicit consent is required if particularly sensitive data is involved or if profiling with high risk occurs – for example, advertising tracking across multiple websites.
• Consent obtained through misleading design («dark patterns») is not valid.

If your website is specifically directed at customers in the EU, additional EU law may apply: the General Data Protection Regulation (Art. 3 GDPR) and the EU's ePrivacy rules. According to these, consent is usually required beforehand for most non-essential cookies. Clarify this if you sell to the EU.

What happens if it is missing?

The DSG only punishes intentional violations – for example, someone who deliberately fails to comply with the information obligation (Art. 60 DSG). The fine is up to CHF 250'000, is only prosecuted upon request, and generally applies to the responsible person, not the company. Only if a maximum of CHF 50'000 is at stake and the responsible parties can only be identified with disproportionate effort can the company be fined (Art. 64 DSG). Such cases are prosecuted by the cantons; the FDPIC can file a report but cannot impose fines itself.

More important than any fine: A website without a reachable company and without a privacy policy appears unprofessional – especially where someone is trusting you with their data.

Checklist

• Imprint with company name, postal address and email – accessible from every page.
• Privacy policy with responsible party, purposes, recipients and countries abroad – also in the footer of every page.
• All services that receive data listed: hosting, form, newsletter, statistics, maps, videos, payment.
• Cookie notice with option to decline; sensitive trackers only after consent.
• Check once a year: Have new services been added? Is data going to new countries?

Sources

1. SECO – Online commerce: Obligations under Art. 3 para. 1 lit. s UWG
2. Federal Data Protection Act (DSG, SR 235.1), Art. 19, 60, 61, 64 and 65
3. Federal SME Portal – E-commerce sites and data protection
4. FDPIC – Guide on data processing using cookies and similar technologies, Version 1.1 from October 6, 2025 (PDF)
5. LAW.CH – Penal provisions of the Data Protection Act
6. EU General Data Protection Regulation (GDPR), Art. 3 – Territorial scope
7. EU Directive on Privacy and Electronic Communications (2002/58/EC, «ePrivacy»), Art. 5 para. 3 – Cookies

All sources retrieved on October 11, 2026. General information, not legal advice. The law and information from authorities are authoritative – consult a specialist in individual cases.