Skip to content
Scheidegger Webpublishing Webpublishing, Switzerland

Digital regulation

Review of digital product and data regulation

The regulation of digital products is changing in kind: it no longer targets only the processing of data, it targets the product itself, how it is designed, how it is updated and how its flaws are disclosed. This review follows that shift text by text, deadline by deadline, and never asserts what it cannot show.

Review RSS feed

The method, so it can be held against us

  1. 01

    Only official texts and the authorities that apply them count as sources: the Official Journal of the European Union, Fedlex, the European Commission, ENISA, the Swiss Federal Council, the OFCS, the FDPIC. A law firm’s commentary, an agency guide or an advisory note are not sources: they are readings, and we produce one of our own.

  2. 02

    Every statement of fact carries a note reference, and every note points to the precise article, annex or recital. A note pointing at a whole text points at nothing.

  3. 03

    Every article displays the date on which its texts were reopened and read again. The law cited here moves, and an article of law with no verification date cannot be dated, so it cannot be believed.

  4. 04

    What could not be verified is left out, however widely it is repeated elsewhere. A later correction is dated and flagged, never slipped quietly into the old text.

  1. 6 min read Texts verified on 28 September 2026

    Cookie banners in Switzerland: does your site need one?

    Swiss law does not require a consent banner on every site. What Article 45c of the Telecommunications Act says, what the Federal Commissioner holds, and what changes once a site targets Europe.

    Telecommunications Act of 30 April 1997 (TCA), SR 784.10, Art. 45c · Federal Act on Data Protection (FADP), SR 235.1 · FDPIC, guide on data processing by means of cookies (version of 6 October 2025) · Directive 2002/58/EC, Art. 5(3)

  2. 8 min read Texts verified on 14 August 2026

    Switzerland and the European Union: when both data protection regimes apply together

    A Swiss business that runs a website is subject to the revised FADP. It may be subject to the GDPR at the same time. Scope, the adequacy decision, the obligations that genuinely diverge, and a method for not running two compliance programmes in parallel.

    Federal Act on Data Protection (FADP), SR 235.1 · Data Protection Ordinance (DPO), SR 235.11 · Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) · Commission Decision 2000/518/EC on the adequate protection of personal data provided in Switzerland · Commission Report COM(2024) 7 final, review of the adequacy decisions

  3. 8 min read Texts verified on 14 August 2026

    Reading a processor contract without being a lawyer: the eight points of Article 28

    Every GDPR processor contract must contain eight items required by Article 28. Here they are one by one, with what each means when you are not a lawyer.

    Regulation (EU) 2016/679 (GDPR) · Commission Implementing Decision (EU) 2021/915, standard contractual clauses between controllers and processors · EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR · Federal Act on Data Protection (FADP, SR 235.1)

  4. 8 min read Texts verified on 14 August 2026

    Controller or processor: who answers for what, and why the label is not enough

    The GDPR divides obligations between controller and processor. What Article 4 says, what the Court of Justice has held, and why the label in the contract does not bind the authority.

    Regulation (EU) 2016/679 (GDPR) · Federal Act on Data Protection (FADP, SR 235.1) · EDPB, Guidelines 07/2020 on the concepts of controller and processor · CJEU, 29 July 2019, Fashion ID, C-40/17 · CJEU, 5 June 2018, Wirtschaftsakademie Schleswig-Holstein, C-210/16

  5. 15 min read Texts verified on 1 August 2026

    The Cyber Resilience Act: what the Regulation requires and when it applies

    Regulation (EU) 2024/2847 subjects products with digital elements to cybersecurity requirements and CE marking. The timeline, the obligations, and who is caught by it.

    Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L of 20.11.2024 · Directive (EU) 2022/2555 (NIS 2) · Regulation (EU) 2016/679 (GDPR)

  6. 9 min read Texts verified on 1 August 2026

    Switzerland and the Cyber Resilience Act: two timetables, one manufacturer

    Switzerland has no CRA equivalent, yet already requires some software makers to report cyberattacks within 24 hours. What applies to a Swiss manufacturer selling into the EU, and from when.

    Information Security Act (ISA), SR 128, as at 1 April 2025 · Cybersecurity Ordinance of 7 March 2025 (OCyS), SR 128.51 · Swiss Federal Council, press release of 20 August 2025 on the cyber resilience of digital products · Regulation (EU) 2024/2847 (Cyber Resilience Act)

And for what already applies

The regulation file sets out, question by question, what a website must comply with today in Switzerland, the European Union and elsewhere. The review follows the texts that are going to change it.

Open the regulation file

This review is not legal advice

The house builds and maintains websites, it does not practise law. What is written here is a reading of the texts, kept current and sourced, meant to let a decision-maker know what applies to them and from when. A particular situation, a dispute or a binding compliance exercise calls for a lawyer’s opinion.