The revised Federal Act on Data Protection (nFADP, or revDSG in German) came into force in September 2023, and it applies to every Swiss business that processes personal data — including your campsite. If you take a name, a car plate and a date of birth at check-in, you are in scope.
The good news: for a well-run campsite, compliance is mostly about a few clear habits, not a legal department. Here is the plain-language version.
What actually changed
The old law dated from 1992. The revision brings Switzerland closer to the EU’s GDPR, with three shifts that matter to you:
- Only natural persons are protected now — data about companies is no longer covered.
- Privacy by design and by default is an explicit obligation: systems should collect the minimum and protect it without you configuring anything.
- Penalties are now personal. Fines of up to CHF 250,000 can be levied against the responsible individual, not just the company.
That last point is why “we’ll deal with it later” is the wrong answer.
The data a campsite actually holds
Most sites hold more than they think. A typical guest record includes name, address, email, phone, vehicle registration, dates of stay, and — for the Meldeschein — often a passport or ID number and date of birth. That is squarely personal data, and ID numbers can count as sensitive data, which carries stricter handling rules.
The principle to internalise: you may only keep what you actually need, for as long as you actually need it.
The five things you genuinely need
You do not need a compliance officer. You need these five in place:
- A privacy notice guests can read — what you collect, why, and how long you keep it.
- A record of processing activities — a simple list of what data you hold and where. Businesses under 250 employees are largely exempt from the full register, but a short internal note is still smart.
- Data minimisation — stop collecting fields you never use.
- A retention schedule — delete guest data on a defined timeline instead of keeping ten years of check-ins “just in case.”
- A way to answer access and deletion requests — a guest can ask what you hold and ask you to erase it.
Where most sites slip
The two failure points we see most often:
- The shared spreadsheet. Guest data in an Excel file on a laptop, emailed between staff, is almost impossible to secure, minimise or delete on schedule. It is the single biggest nFADP liability on most sites.
- Never deleting anything. Retention is the rule people forget. If you cannot explain why you still hold a 2019 guest’s passport number, you should not be holding it.
How the right system removes the work
Compliance stops being a project when the software does it by default. In practice that means guest data is access-controlled per staff role, the Meldeschein is generated and retained on a fixed schedule, sensitive fields are minimised, and everything is deleted automatically when its retention window closes — hosted on servers in Switzerland so it never leaves the jurisdiction by default.
You do not configure privacy by design. You inherit it.
The one-paragraph summary
If you take one thing away: stop holding guest data in loose spreadsheets, and give every piece of data an expiry date. Do that, publish a plain privacy notice, and be able to answer a guest who asks what you hold — and you have covered the overwhelming majority of what the nFADP asks of a campsite.