Swiss FADP and Live Chat: Rules for Swiss Websites

Swiss FADP and live chat meet the moment a visitor types a first message into a widget on a Swiss website: a name, an e-mail address, an IP address and the content of the question are all personal data under the revised Federal Act on Data Protection, in force since 1 September 2023. The law is close to the GDPR in spirit but not identical in detail, and a Swiss business that copies an EU checklist without reading the differences will miss a few obligations that the Swiss regulator takes seriously.

This guide explains what the FADP requires of a website that runs live chat and an AI assistant, where it differs from the GDPR, what to put in your privacy notice, how to handle data going abroad, and how to configure Mio, the AI assistant in Talkmio, so the chat stays inside the rules. It is practical guidance, not legal advice; for a specific situation, speak to a Swiss data-protection lawyer.

What the Swiss FADP Covers in a Live Chat

The revised act, the “nFADP” or “revDSG” in Swiss usage, protects natural persons only; data about companies is no longer covered, which simplifies B2B chat. It applies to any processing that has an effect in Switzerland, even by a company based elsewhere, so a German shop with Swiss customers and a chat widget falls under it. The full text is published on the federal law portal, Fedlex SR 235.1, and the supervisory authority is the Federal Data Protection and Information Commissioner, the FDPIC.

In a chat, the personal data in scope typically includes the visitor’s name and e-mail if asked for, the IP address, country, device and browser shown in the Inbox, the pages viewed, and the text of the conversation itself, which may contain anything the visitor chooses to write, including health or financial details that count as sensitive personal data under the act.

Swiss FADP vs GDPR: What Changes for Chat

If you already comply with the GDPR you are most of the way there, but not all of it. The table lists the points that matter for a chat widget.

Topic	GDPR	Swiss FADP	What it means for live chat
Legal basis	Required for every processing (consent, contract, legitimate interest…)	No general legal basis needed; processing is lawful unless it breaches principles or the person objects	Running a chat does not need a consent banner by default; transparency does the work
Information duty	Detailed notice (Art. 13/14)	Notice of identity, purpose, recipients and, importantly, the countries data goes to	Name every country where chat data is stored or processed
Transfers abroad	Adequacy or safeguards	Federal Council list of adequate countries; otherwise safeguards, with the destination disclosed	EU countries are on the list; check any AI provider’s location
Records of processing	Most organisations	Companies with 250+ employees, or any size for high-risk processing	Small businesses usually exempt
Data protection officer	Mandatory in defined cases	Voluntary “data protection adviser”	Optional
Breach notification	72 hours to the authority	“As soon as possible” to the FDPIC when risk is high	Have a process; no fixed clock
Sanctions	Fines on the company	Criminal fines up to CHF 250,000 on responsible individuals, on complaint	Personal liability for intentional breaches of information or security duties
Automated decisions	Art. 22 rights	Must be announced if they have legal effect or significant impact	An AI assistant answering questions is not an automated decision; one that denies a refund might be

Transparency: What Your Privacy Notice Must Say

The FADP’s information duty is the heart of compliance for live chat. Before or at the time data is collected, the visitor must be able to learn who the controller is, what the data is used for, who receives it and which countries it may be sent to. For a chat widget that means a privacy notice that states:

that the website uses a live chat provided by a named processor, and what the processor stores (conversation text, e-mail if given, IP, country, device, pages viewed);
that an AI assistant answers questions, and that conversation text plus relevant knowledge-base excerpts are sent to an AI model provider to generate the answer;
the countries involved: Talkmio stores data on servers in the EU, in Germany, so Germany is named; add the country of any other provider in the chain;
how long conversations are kept, which depends on your plan: 30 days of history on Free, 365 days on Pro, unlimited on Ultimate, unless you delete sooner;
how to request access, correction or deletion, which Talkmio supports on request to support.

Switzerland has four national languages. If your site serves German, French and Italian speakers, the notice should exist in each language your site uses. A short line next to the widget linking to the full notice is good practice; a consent checkbox is not required by the FADP for ordinary chat, though it remains sensible if you intend to use chat data for marketing. Our general live chat privacy policy guide has a template structure you can adapt.

Data Going Abroad: Germany, the EU and the AI Provider

The FADP allows transfers to countries the Federal Council has recognised as providing adequate protection, and the EU and EEA member states are on that list. Storage in Germany therefore needs no additional safeguard, only disclosure. The point to check is the AI model provider: ask the vendor where answers are generated. Talkmio’s documentation states that only the conversation text and relevant knowledge-base excerpts are sent to the AI model provider, which limits what leaves the EU storage, but your notice must still name the destination country if it is outside the adequacy list, and a transfer safeguard such as standard contractual clauses must be in place. The same analysis for EU businesses is covered in our EU data residency guide.

Sensitive Data in Conversations

Visitors write what they want. A clinic’s chat will receive symptoms; a lawyer’s chat will receive case details; a bank’s chat will receive account questions. Under the FADP, health, religious, political, genetic, biometric data and data on criminal proceedings are sensitive, and sensitive data disclosed to third parties needs explicit consent or a legal justification. Two practical controls help. First, business instructions for the assistant: tell Mio to answer general questions only and hand over anything about a specific person’s situation; it hands over automatically when the content does not cover the question or the visitor asks for a person. Second, retention: delete conversations that contain sensitive data once the matter is closed, rather than keeping unlimited history by default. Our data retention guide walks through a schedule.

Security Duties and Who Is Liable

The act requires technical and organisational measures appropriate to the risk, and the ordinance spells out minimum points: access control, logging for sensitive processing, and the ability to restore data. For the chat side, that means role-based access in the Inbox, where Agents handle conversations and Admins also manage settings, operators with their own logins rather than a shared one, and the mobile app protected by the device’s own lock. The Swiss twist is that fines fall on responsible individuals for intentional breaches of the information, cooperation and minimum-security duties, not on the company as under the GDPR. The person who decides to skip the privacy notice is the person at risk.

Data Processing Agreement With Your Chat Vendor

A chat provider is a processor, and the FADP requires that the controller ensures the processor handles data only as instructed and with appropriate security, and that sub-processors are engaged only with the controller’s approval. Ask the vendor for a data processing agreement that names sub-processors, including the AI model provider, and the countries involved. The checklist in our guide to the data processing agreement for live chat was written for the GDPR but maps onto the Swiss requirements almost one to one.

Configuring Mio for Swiss FADP Compliance

Pre-chat form. Under Websites you can set the form to none, optional or required. For most Swiss sites “optional” collects the least data while allowing follow-up; “required” is justified where you need an e-mail to reply.
Business instructions. State what Mio sells and answers, and instruct it to hand over any question about a specific individual’s health, legal or financial situation.
Knowledge base hygiene. Mio answers only from your content. Do not upload documents containing customer personal data; the knowledge base is for policies, products and procedures.
Retention. Decide how long conversations stay and delete on schedule. Export or deletion is available on request to support.
Languages. Mio replies in the visitor’s language, so German, French, Italian and English visitors are served from one knowledge base; your privacy notice should match.
Access requests. Contacts keeps every person who ever wrote with their history, which makes finding and exporting one person’s data straightforward when they ask.

Plans and prices, in euros, are on the pricing page; the retention figures above come from the plan history limits listed there.

A Short Compliance Checklist

Privacy notice names the chat processor, the AI step, Germany and any other destination country, retention and rights.
Notice available in each language your site uses.
Data processing agreement signed, sub-processors listed.
Pre-chat form set to collect only what you need.
Business instructions hand sensitive and individual matters to a person.
Retention schedule written down and followed.
Breach process: who tells the FDPIC and the visitors, and how fast.
Individual logins for every operator; mobile app behind a device lock.

Frequently Asked Questions

Does the Swiss FADP require consent to use live chat?

Not for ordinary chat. Unlike the GDPR, the FADP does not demand a legal basis for every processing; processing is lawful if it follows the principles and the person is properly informed. A clear privacy notice that names the processor, the AI step, the countries and retention is the key obligation. Consent becomes relevant for sensitive data shared with third parties or for marketing use.

Is storing chat data in Germany allowed under Swiss law?

Yes. EU and EEA states are on the Federal Council’s list of countries with adequate data protection, so storage in Germany needs no extra safeguard, only disclosure in the privacy notice. Check separately where the AI model provider processes conversation text and name that country too if it is outside the adequacy list.

Do I need a data protection officer for a chat widget?

No. The FADP makes a data protection adviser voluntary for private companies. Records of processing activities are only mandatory for companies with 250 or more employees or for high-risk processing. A small Swiss business running live chat typically needs a privacy notice, a processing agreement with the vendor and sensible security, not a formal officer.

Is an AI assistant answering chats an automated individual decision?

Answering questions from your pages is not a decision with legal effect, so no announcement duty arises. If you configured an assistant to decide refunds, approve applications or deny service on its own, that would be an automated decision and the visitor must be told and able to request human review. Mio answers from content and hands decisions to your team.

What happens if chat data leaks?

The controller must notify the FDPIC as soon as possible when the breach is likely to pose a high risk to the people concerned, and inform those people when needed for their protection. There is no fixed 72-hour clock as under the GDPR, but a written process naming who assesses and who notifies should exist before anything happens.

Who pays the fine under the FADP, the company or a person?

The responsible natural person. The FADP provides criminal fines of up to CHF 250,000 for intentional breaches of the information, cooperation and minimum-security duties, prosecuted on complaint, and they are imposed on the individual who is responsible rather than on the company as such, although fines on companies are possible in limited cases.

The Bottom Line

Swiss FADP and live chat come down to transparency, honest disclosure of where data goes, a processing agreement with your vendor and restraint about what the assistant answers on its own. The law does not require a consent banner for ordinary chat, but it does hold individuals responsible for skipping the notice. Set up the privacy notice in your site’s languages, configure Mio to hand over anything about a specific person, and write down your retention rule. Create a free Talkmio account and put the chat on your Swiss site with EU storage from the first message.

Swiss FADP and Live Chat: What Swiss Websites Need to Know