Making Your Website Data-Protection Compliant: revDSG and GDPR for SMEs

Ever since the revised Data Protection Act (revDSG) came into force, the same question keeps coming up for many SMEs: do I now have to change something on my website? The short answer is usually yes, but fortunately it's no rocket science. In the vast majority of cases it comes down to a few concrete, manageable things. In this article I'll explain, without legalese, what the revDSG means for your website and how to make it clean step by step.

Up front, so it's clear: I'm a web developer, not a lawyer. What you read here is practical experience from real SME projects, not legal advice. In sensitive cases you should consult a specialist, but for most small company websites, common sense and a good checklist are enough.

revDSG and GDPR, what actually applies to you?

Two terms are floating around, and that causes confusion. The revDSG is the Swiss data protection law that has applied since September 2023. The GDPR is the European counterpart. The good news: the two are very similar. Whoever meets the revDSG is usually close to the GDPR too.

And do you as a Swiss SME even need the GDPR? As soon as you regularly address or serve customers in the EU, for instance with an online shop that ships to Germany, yes. If your website targets Switzerland only, the revDSG is what matters most. In practice I build in both right from the start, because the effort is minimal and it keeps you on the safe side.

The privacy policy: your most important document

The centrepiece is the privacy policy. It's not optional but mandatory, and it should be easy to find in the footer, linked on every page. In it you explain in understandable language which data you collect and for what purpose.

A solid privacy policy typically answers:

• Who is responsible? Name, company and a contact address.
• Which data is collected? For example via the contact form, cookies or server logs.
• For what and how long? The purpose and how long you keep the data.
• Which services are involved? Google Analytics, fonts, maps, newsletter tools.
• What rights do visitors have? Access to, correction and deletion of their data.

You don't have to write it yourself. There are reputable generators, and I help my clients set up a fitting policy that matches the services actually used. The one thing that matters: it has to be honest. A privacy policy that lists services you don't even use, or conversely conceals some, is worse than none at all.

Cookies and the banner: less is more

Cookie banners are what most people think of first, and what most often gets done wrong. The core: you may only set tracking cookies, for instance from Google Analytics, after the visitor has consented. A banner that activates everything as soon as the page loads does you no good.

My advice to SMEs: keep it lean. Many small company websites need no intrusive banner at all if you forgo unnecessary tracking. Technically necessary cookies, for instance for a contact form, are unproblematic. Only once statistics or marketing services come into play do you need consent. Often the simplest solution is to work data-sparingly, rather than measuring every click.

Contact form and external services

The contact form is the central data channel on almost every SME website. Here are two things that often get overlooked:

• Encryption: Your website must run over HTTPS so entries are transmitted securely. That's standard today, but check it.
• External services: Google Fonts, embedded maps or videos often load data from third-party servers. Here it helps to embed fonts locally and to load maps only on click.

These details go unnoticed by visitors but make the difference between a website that «somehow works» and one that's built clean. How a technically clean site also becomes faster, you can read in other articles.

Your short checklist

If you take away only three things, then these:

• An honest, well-linked privacy policy in the footer.
• Tracking only after consent, or forgo it entirely.
• HTTPS active and external services used deliberately.

That covers the bulk for the vast majority of small company websites. It's not about being perfect, but responsible, and your visitors notice that.

Better to start clean than patch up later

Data protection sounds like bureaucracy, but at heart it's a matter of decency: you handle your customers' data carefully. Whoever thinks of this from the start saves themselves later patchwork and comes across as more trustworthy along the way. A website that openly says what it does with data builds trust, and trust sells.

If you're unsure whether your site meets the revDSG, I'm happy to take a non-binding look. Just get in touch via the contact form, and we'll go through the points together. You'll find more tips on a good SME website in other articles.