What must a privacy notice contain?
By Advisorn · updated on 17 October 2026 · Art. 19-21 FADP, Art. 13-14 GDPR
In short
When it collects personal data, the business must inform people at least of: its identity and contact details, the purpose of the processing, the recipients or categories of recipients and, if the data is disclosed abroad, the State and the safeguards (Art. 19 FADP). If the data is not collected from the person, the categories of data processed must also be stated.
Form and timing
The law prescribes no form: usually it is a privacy notice on the website, to which forms, contracts and e-mails refer. The information must be given when the data is collected; if the data comes from others, within one month at the latest (Art. 19 para. 5 FADP).
If a decision with legal effects is based exclusively on automated processing, the person must be informed (Art. 21 FADP).
If the GDPR applies too
- the legal basis of each processing;
- the retention period or the criteria;
- the rights of the person, including the complaint to the authority;
- the contact details of the DPO, if there is one.
The exceptions
There is no need to inform someone who already has the information, nor when the processing is provided for by law (Art. 20 FADP). The information may be restricted to protect overriding interests of third parties or of the business.
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.