nLPD and website: the technical compliance checklist for SMEs in French-speaking Switzerland

On the Swiss web, your website is the very first showcase of your professional rigour. Within seconds, a demanding prospect, an auditor or a competitor can check whether your platform complies with the legal framework. And contrary to an idea that is still too widespread among SMEs, reconciling nLPD and website is not just a matter of copy-pasting a legal notice page or hurriedly installing a cookie plugin.

Since the new Federal Act on Data Protection (nLPD) came into force, compliance requires the concrete application of the principles of Privacy by Design (protection from the outset) and Privacy by Default (protection by default). In plain terms: compliance is first and foremost a matter of technical architecture, code management and control of data flows.

From the silent loading of Google Fonts to the execution of third-party scripts before the user has even made a choice, and including contact forms without explicit validation, flaws invisible to the naked eye remain numerous on showcase and e-commerce sites. Beyond the legal risk, a poorly configured site degrades your display performance, tarnishes your reputation and skews your audience statistics.

Whether you run a WordPress or Shopify site or a custom development, this article sets aside the legal jargon to give you an operational technical compliance checklist. Step by step, find out how to audit your dependencies, clean up your code and secure your users’ experience while preserving the commercial effectiveness of your platform.

Pillar 1: Information and transparency (the user interface / Front-End)

On a website subject to the nLPD, the user interface (Front-End) is the first line of compliance. This is where the contract of trust between your SME and your visitors is established. Transparency must not be hidden in impenetrable jargon: it must be clear, immediately accessible and user-friendly.

The Data Protection Statement (DPD): mandatory and permanent

The Data Protection Statement (often called a Privacy Policy) is the central document required by the nLPD. It must never be inaccessible or hidden behind a complex journey.

• Permanent access: a direct, clearly visible link must appear in the footer of 100% of your website’s pages, under the explicit name “Data protection” or “Privacy policy”.
• Mandatory notices under the nLPD:
  1. The identity of the data controller: the legal name of your business, a postal address in Switzerland and a dedicated contact email address for data-related requests.
  2. The precise purposes of collection: clearly explain why you collect data (e.g. order processing, audience measurement, sending newsletters, ad targeting).
  3. The list of third-party processors: mention the tools and platforms that process data on your behalf (web host, Google Analytics, CRM, payment solutions such as TWINT).
  4. Transfers abroad: state whether data is hosted or processed outside Switzerland or the European Union (notably in the United States) and what legal safeguard the transfer relies on.
  5. The rights of Swiss users: remind them of the procedure for exercising their right of access, rectification, objection and deletion of their personal data.

The consent banner (CMP): the rules of a valid Opt-In

The nLPD requires user consent to be free, informed and specific whenever you collect personal data that is not strictly necessary for the site to function (advertising cookies, tracking pixels, behavioural analytics tools).

To ensure the technical compliance of your CMP (Consent Management Platform):

• Blocking beforehand (mandatory Opt-in): no non-essential tracking script (Google Analytics, Meta Pixel, LinkedIn Insight Tag) may run before the visitor has expressed their choice.
• Equal choices (no Dark Patterns): the “Reject all” (or “Continue without accepting”) button must be as visible and accessible as the “Accept all” button. Hiding the refusal option or relegating it to greyed-out text is considered a deceptive practice.
• No pre-ticked boxes: in the detailed settings panels (by cookie category), all boxes relating to non-essential cookies must be unticked by default.
• A simple right to withdraw: users must be able to change or withdraw their consent at any time. Good practice is to leave a discreet mini-widget or a permanent link in the footer (e.g. “Manage my cookie preferences”).

Web forms: distinguishing contact from prospecting

Whether it is a quote request form, a contact form or an event registration, every data collection field must respect the principle of data minimisation.

• The consent checkbox: add an unticked checkbox with clear text and a link to the Data Protection Statement: Example: [ ] J'accepte que mes données soient traitées pour répondre à ma demande de contact conformément à la Politique de confidentialité.
• Strict separation of purposes: you cannot automatically add to your marketing newsletter a prospect who has simply filled in a form to request a quote. If you want to subscribe them to your news, a separate, optional box must be offered.
• Systematic Double Opt-In for newsletters: for any mailing list sign-up, you must send a confirmation email containing a validation link. This mechanism (Double Opt-In) ensures that consent is traceable and protects your databases against fraudulent or mistaken sign-ups.

Pillar 2: Cleaning up code and third-party dependencies (Under the Hood / Back-End)

While the visible part of your site (Front-End) handles the user relationship, the most frequent data leaks hide in its source code and background scripts (Back-End). To ensure the compliance of a website with the nLPD, you must review the invisible external dependencies that transmit personal data (starting with your visitors’ IP address) to unauthorised third parties.

The trap of external fonts (Google Fonts)

This is one of the most common flaws and one of the easiest to fix. By default, many web themes (notably on WordPress) load fonts directly from Google's servers (fonts.googleapis.com or fonts.gstatic.com).

• The technical problem: When a user visits your page, their browser automatically sends an HTTP request to Google’s servers to download the font. On this occasion, the visitor’s IP address is transmitted in clear text to American servers, without prior consent and without a hosting agreement. Yet under Swiss law (as under European law), an IP address is personal data.
• The technical solution: self-host all of your fonts on your own website’s server.
  1. Download the font files in a modern, lightweight format (.woff2).
  2. Store them in your site’s assets folder (e.g. /wp-content/themes/votre-theme/fonts/).
  3. Declare them directly in your CSS stylesheet using the rule @font-face.
• The secondary benefit: by eliminating the external DNS call to Google, you gain precious milliseconds in your site’s loading time (PageSpeed), a direct SEO optimisation criterion.

Embedding external media and maps (YouTube, Vimeo, Google Maps)

Simply embedding a YouTube video, a Vimeo player or a Google Maps map with an iFrame creates an immediate compliance problem.

• The technical problem: as soon as the page loads, the tag <iframe> opens a connection to the third-party service's servers and places behavioural tracking cookies on the visitor's device, even if they have never pressed the “Play” button.
• The technical solutions:
  1. Use the enhanced integration domain: for YouTube, systematically replace the standard URL [youtube.com/embed/](https://youtube.com/embed/) by the privacy-friendly domain [youtube-nocookie.com/embed/](https://youtube-nocookie.com/embed/).
  2. Set up a “Click-to-Load” mechanism (two-click solution): block the iFrame from loading by default. Display a static preview image instead, overlaid with an explanatory message: “By clicking this button, you accept the loading of the Google Maps map and the associated interactivity.” The iFrame and its cookies only run when the user explicitly clicks.

Tag governance with Google Tag Manager (GTM)

Google Tag Manager is a great tool for centralising your marketing scripts, but it can quickly become a data sieve if it is poorly configured.

• The technical problem: if your tags (Meta Pixel, LinkedIn Insight Tag, Hotjar, Google Analytics) are tied to the default “All Pages” (Page View) trigger, GTM will run these scripts instantly when the page is accessed, completely ignoring the user’s consent status in the CMP.
• The technical solution:
  1. Make tag firing conditional: link each marketing tag to a custom trigger that depends on the consent given on the cookie banner (e.g. the custom event consent_status_update sent by your CMP).
  2. Check strict blocking: an advertising tag (e.g. Meta Pixel) must only fire that if the consent category ad_storage or marketing returns the value granted.
  3. Audit the GTM container regularly: remove old test tags, third-party scripts that are no longer needed and pixels from past providers.

Pillar 3: Data security and web hosting

Beyond transparency and consent, the nLPD imposes a strict security obligation: the company responsible for the processing must ensure that the personal data collected on its website is protected against unauthorised access, loss or accidental disclosure. The technical security of your web infrastructure is therefore the third inseparable pillar of your compliance.

Encryption and transfer security (SSL / TLS)

Data transfer between your visitors’ browser and your web server must be fully secured.

• Widespread HTTPS: your website must have a valid, active SSL/TLS certificate on 100% of URLs. An automatic 301 redirect must be configured to systematically send all HTTP traffic to the secure HTTPS address.
• The encryption level: make sure your server supports recent versions of the encryption protocols (TLS 1.2 at minimum, TLS 1.3 recommended) and disable the obsolete older protocols (SSL v3, TLS 1.0, TLS 1.1) that have known security flaws.
• Form protection: data entered in your contact, order or sign-up forms must travel encrypted. A site displaying a “Not secure” warning in the address bar is a direct breach of the nLPD and drives your visitors away in an instant.

Data location and web hosting sovereignty

The nLPD strictly regulates the transfer of personal data abroad. If you send data to a country whose level of protection is judged insufficient by the Federal Council (such as the United States without specific safeguards), you expose yourself to major legal complications.

• The advantage of hosting in Switzerland or the EU: choosing a web host with datacentres located in Switzerland or in the European Union ensures that your data benefits from an adequate level of protection recognised by Swiss law.
• Backup management (Backups): automatic backups of your site and its database (which contain customer data, addresses and emails) must not be stored on unsecured consumer cloud services. Make sure your backups are encrypted and hosted in a compliant environment.
• Subcontracting agreements (DPA): check that your web host offers a data processing contract (Data Processing Agreement) formalising its commitments on security, confidentiality and incident management.

C. CMS security and data breach management (Data Breaches)

Whether you use WordPress, Shopify, Drupal or a custom development, content management systems (CMS) are prime targets for cyberattacks. An unmaintained site quickly becomes an entry point for hacks and data leaks.

• Ongoing technical maintenance:
  • Apply security updates to the CMS core (Core), themes and extensions/plugins as soon as they are released.
  • Remove plugins that are outdated, no longer maintained by their publishers or unused.
  • Set up a plugin or a web application firewall (WAF) to block brute-force intrusion attempts.
• Mandatory management of data breaches (nLPD alert procedure): In the event of a security incident leading to a leak of personal data (e.g. a hack of your forms database or unauthorised access to your CRM):
  1. The nLPD requires you to notify the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible.
  2. If the incident poses a high risk to your users, you must also inform the individuals concerned directly.

Key takeaway: Setting up encrypted daily backups and a preventive maintenance plan is not just a technical recommendation: it is your best insurance against the consequences of a data leak under the nLPD.

nLPD and website: the operational checklist

Here is a summary of the 10 essential checkpoints to audit to ensure your website is technically aligned with the nLPD. Use this table with your technical team or web agency to identify the items to fix first.

| # | Control item | What to check technically | Status | | 1 | SSL / HTTPS encryption | Valid SSL certificate on 100% of pages, automatic 301 redirect from HTTP to HTTPS, TLS 1.2+ protocols enabled. | [ ] | | 2 | Permanent access to the privacy policy | Direct, readable and permanent link to the Data Protection Statement present in the footer of every page. | [ ] | | 3 | Prior opt-in (CMP) | No non-essential cookie (analytics, advertising) runs before the user’s explicit consent. | [ ] | | 4 | Equal CMP choices | The “Refuse” or “Continue without accepting” button is as visible and as easy to reach as the “Accept” button. | [ ] | | 5 | Contact forms | Non-pre-ticked consent box linked to the privacy policy; no automatic ticking for newsletter sign-ups. | [ ] | | 6 | Email capture & newsletters | Procedure for Double Opt-In always enabled to validate any mailing list sign-up. | [ ] | | 7 | Fonts (Google Fonts) | Font files hosted locally on your web server (.woff2) without calling fonts.googleapis.com. | [ ] | | 8 | Third-party media integration | Videos embedded via youtube-nocookie.com or disabled by default until the user clicks (Click-to-Load). | [ ] | | 9 | Google Tag Manager & Consent Mode | GTM triggers conditioned on the CMP and configuration of the Google Consent Mode v2 for conversion modelling. | [ ] | | 10 | Hosting & Data Processing | Servers and backups located in Switzerland or the European Union, DPA contract signed with the host. | [ ] |

Technical compliance, an ongoing process

Ensuring that a website complies with the nLPD is not a one-off legal step. It is a global technical clean-up that touches the architecture of your code, the user experience and the control of your marketing tools.

A clean, fast, encrypted and privacy-respecting website inspires immediate trust among Swiss users, while improving your organic search (SEO) performance and display speed.

🔗 Also worth reading: once your platform is technically compliant, find out how to make privacy a decisive selling point in our dedicated article: [Privacy-First Marketing: turning the nLPD into a growth lever for your business].

🛠️ Need a technical nLPD diagnosis of your website?

Are you unsure about the compliance of your scripts, the configuration of your CMP or the management of your fonts and GTM tags?

👉Request a technical audit of your website with the Smart Impact experts. Our teams carry out a full diagnosis of your data flows and support you in bringing your platform into technical compliance in French-speaking Switzerland