Data protection for online shops: Swiss FADP, GDPR, cookies and newsletters
By Advisorn · updated on 26 October 2026
In brief
A Swiss online shop falls under the FADP and, if it offers its products to people in the EU (deliveries, prices in euros, a site in their languages), also under the GDPR (Art. 3 para. 2 GDPR). It needs a privacy notice on the website, a cookie banner suited to its audience, consent for the newsletter (Art. 3 para. 1 let. o UCA) and contracts with its providers, often with data in the United States.
The typical data
- customer accounts, delivery and billing addresses;
- orders, returns and correspondence with customer service;
- payment data, as a rule processed by the payment provider;
- cookies, analytics and advertising data;
- newsletter subscriptions and reviews.
Sensitive personal data
As a rule none, but beware of products that reveal it: medicines, health or religious items may allow conclusions about health or beliefs. Personalised recommendations based on a lot of data may be profiling (Art. 5 let. f FADP).
When the GDPR applies as well
The GDPR applies if the shop targets people in the EU: it ships to the EU, shows prices in euros, or has a site in the language of a Member State designed for that market. In that case a representative in the EU is also needed (Art. 27 GDPR), unless the processing is occasional and low-risk; and for non-essential cookies the Member States' laws implementing the ePrivacy Directive require the consent of visitors from the EU.
The typical providers
- the shop platform and the hosting;
- the payment provider;
- the carrier;
- the newsletter tool;
- the analytics and advertising tools, often in the United States.
Newsletters
Advertising e-mails require consent, except to customers for similar products if they were told they could refuse (Art. 3 para. 1 let. o UCA). Every mailing must offer an easy way to unsubscribe.
Related questions
- Revised FADP and GDPR: what are the differences, and when do both apply?
- Cookies and banners: is consent required in Switzerland?
- Newsletters: is consent needed to send marketing e-mails in Switzerland?
- Can I use vendors with servers in the United States or the EU?
- What is profiling, and when is it high-risk?
- A person asks for their data to be deleted: what should we do?
Useful templates
- Website privacy notice template (FADP and GDPR)
- Cookie policy template for Swiss and European websites
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Template for assessing a transfer of data abroad (TIA)
- Mandate template for the EU representative (Art. 27 GDPR)
- Procedure template for handling data subject requests
The other sectors
General information, not advice on your case: for your case the text of the law is what counts, and for a sector with rules of its own, those rules too.