Checklist: reviewing a privacy notice under the FADP and GDPR
For: Website and app operators
Updated: 2026-11
A privacy notice is reviewed in seven steps: controller and contact, purposes of processing, data categories, recipients and processors, transfers abroad with safeguards, data subject rights and currency against the services actually used. Anyone also targeting people in the EU adds the additional GDPR information.
Under Art. 19 FADP controllers must appropriately inform data subjects when collecting personal data. For websites and apps this happens in the privacy notice. The GDPR requires additional information in Art. 13 and 14, such as legal bases and retention periods.
The most common weakness is not a missing paragraph but a notice that no longer matches the services in use.
The checklist
- 01
Name the controller
Identity and contact details of the controller and, where applicable, the data protection adviser or representative.
Done when: Name, address and a contact for data protection questions are given.
- 02
Describe purposes
Describe the purpose of each processing understandably, such as contact form, newsletter, analytics, customer account.
Done when: Every processing on the website or app is listed with its purpose.
- 03
State data categories
Which data is processed, especially when not collected directly from the person.
Done when: Categories are named per processing.
- 04
List recipients and providers
Recipients or categories of recipients, including hosting, analytics, email and payment services.
Done when: The list matches the services actually used.
- 05
State transfers abroad and safeguards
Countries to which data is disclosed and the safeguards or exceptions under Art. 16 and 17 FADP.
Done when: For each service abroad, country and basis are stated.
- 06
Explain rights
Describe access, rectification, erasure, objection, data portability and the right to complain.
Done when: Rights are described with a way to exercise them.
- 07
Keep it current
Reconcile the notice with services in use and update it on every change.
Done when: The notice carries a date, and reconciliation is part of the process for new services.
Common mistakes
- —Adopting a template that names services not in use and forgets others.
- —Transfers to the US without stating the basis.
- —Adding tracking services after a website update without updating the notice.
- —Writing the notice in legal language nobody understands.
What this checklist does not cover
- —The checklist does not replace legal review of the privacy notice.
- —Sector-specific information duties may apply in addition.
- —Cookies and consent are covered by a separate checklist.
Parent service: Data Protection Consulting
Matching offers
Privacy notice, legal notice and cookies for website and app
We record which services your website or app actually uses and implement a matching privacy notice, legal notice and cookie solution, under the Swiss FADP and, for EU audiences, the GDPR and ePrivacy law. Technically we ensure optional cookies are only set after visitors choose.
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
FAQ
Is an FADP privacy notice enough?
For a purely Swiss offering, yes. Anyone targeting people in the EU generally also needs the GDPR information.
How often should it be reviewed?
Whenever services in use change, and at least annually.
Must every provider be named?
Under the FADP, categories of recipients suffice. For transfers abroad the country must be named; many name services individually for transparency.
More checklists
Checklist: implementing cookies and consent correctly
Cookies are implemented correctly in seven steps: inventory all cookies and trackers, separate necessary from optional, determine the rules for your audience, in Switzerland inform users and allow refusal, for EU visitors set optional cookies only after consent, enforce the choice technically and review regularly.
Checklist: SEO migration in a website relaunch
Visibility is kept in a relaunch in seven steps: record all existing URLs and their performance, redirect every old URL to the matching new one, carry over strong content rather than replacing it, migrate metadata and structured data, test on staging, update sitemap and Search Console after go-live and monitor for weeks.
Checklist: writing a specification for a public IT tender
A specification for a public IT tender is created in seven steps: describe goals and starting point, formulate requirements with priority and acceptance criteria, keep technical specifications product-neutral, set suitability criteria, define award criteria with weighting and scoring method, create a comparable price sheet and review the documents before publication.