Hosting your data in Switzerland: what it changes, what it doesn't

What the law requires, and what it doesn't

The nFADP doesn't require data to stay in Switzerland. It requires knowing where it is, who can access it, and guaranteeing an equivalent level of protection when it leaves the country.

In other words: the obligation is about control, not geography. Swiss hosting is a convenient way to demonstrate it, it's not the only route.

What "hosted in Switzerland" really means

The question isn't only where the disks are. It's also: who runs the service, under which jurisdiction that company falls, and who can be compelled to grant access.

A server physically in Zurich, run by a subsidiary of a group subject to foreign data-access legislation, doesn't offer the same guarantee as an independent Swiss host. The difference is legal, not geographical, and it doesn't show in the sales pitch.

The cases where it really matters

Health data, HR data, professional secrecy, banking secrecy, data on minors, and anything touching a sector-specific obligation. In these contexts, location and the operator's jurisdiction are selection criteria, not preferences.

• Health, insurance, pension provision
• Human resources and payroll
• Professions bound by secrecy
• Subcontracting for a public authority

The cases where it's mostly a selling point

A showcase site with no form, a blog, an online brochure: the server's location protects nothing in particular there. Paying extra for hosting on this kind of project buys peace of mind, not compliance.

It's still a defensible choice: we make it ourselves by default. But you need to know what you're buying.

How to check

Four questions to ask your provider, and the answers must be in writing: which country are the servers in? Which company runs them, and under which jurisdiction? Who has administrator access? What happens to your data if you leave?

A provider who has already had this conversation answers without hesitation. It's the same test as for everything else, in fact.