Where can you host a website or application in line with the Swiss nFADP?
The nFADP does not require data to be hosted in Switzerland. It allows disclosure to countries whose level of protection the Federal Council recognises, such as Germany and the other EU member states. What matters is knowing where your data is, who processes it and under which contract.
At a glance
- nFADP in force since 1 September 2023
- Recognised countries: Annex 1 of the DPO ordinance
- Processing agreement with the host (Art. 9 nFADP)
- People informed of destination countries (Art. 19 nFADP)
- ark.swiss: production in the EU, standby and backups in Switzerland
What the law requires
Article 16 of the nFADP allows data to be disclosed to a country with an adequate level of protection.
These countries are listed in Annex 1 of the Data Protection Ordinance (DPO).
Your host acts as a processor: a contract must govern what it does with your data.
Your privacy notice must state the countries to which data is disclosed.
Questions to ask your provider
In which country are the production servers and backups?
Who can access the data, and from where?
Is the processing agreement signed?
How do you get your data back when the contract ends?
Our infrastructure
Our applications run in production in the European Union.
A warm standby and independent backups are kept in Switzerland.
This guide gives general pointers. For a specific case, consult a lawyer.