A French SME picks Swiss hosting for proximity, perceived neutrality, and documented datacenters. The DPO then reminds them Switzerland is not in the EU — and "friendly country" does not mean "no transfer to document."
Swiss providers such as Infomaniak or Hostpoint are credible for many francophone sites. GDPR compliance then rests on explicit transfer governance, not on border absence.
Transfer or not: reading GDPR correctly
For a controller established in the EU, entrusting personal data to a Swiss provider is a transfer to a third country (GDPR Chapter V).
Two myths persist:
- "Switzerland has similar law, so no formalities." Wrong: lighter formalities ≠ no obligation.
- "My visitors are French, so no transfer." Wrong: it is the processing location by the processor that counts.
The European Commission's adequacy decision (Switzerland) allows transfer without standard clauses to Switzerland, while the framework stays valid and the flow is identified.
| Situation | Typical framework |
|---|---|
| Prod hosting in CH, no other country | Adequacy + DPA + register |
| Backup copied to EU or US | Additional governed transfer |
| Third-party CDN / analytics | Other sub-processor, other analysis |
| Support from non-adequate country | Clauses or supplementary measures |
What the Swiss DPA must cover
Require from the provider:
- Contracting entity (CH).
- Processing description (hosting, email, backup).
- Sub-processor list and change notification.
- Documented security measures.
- Assistance for data subject rights and audits.
Cross-check your processing register and public privacy policy. If you process for clients, reflect the Swiss provider in your downstream DPA.
For Infomaniak specifically, see also Infomaniak and GDPR residency.
When adequacy is no longer enough
Common cases needing additional framework:
- Provider's sub-processor in the US or India (support, monitoring).
- Backup replication to a non-adequate region you chose.
- Email or CRM added later outside Switzerland/EEA.
- Legal change: watch Schrems developments and adequacy updates.
The guide Schrems II and hosting remains useful for method, even though Switzerland currently has its own adequacy decision.
The crux: the Swiss flag does not sign your transfer analysis
"Swiss hosting GDPR" pages imply magic equivalence. Auditors ask for a map, not a flag.
Decide and move forward without blind spots
- Confirm EU establishment and role (controller / processor).
- Sign the DPA with the chosen Swiss host.
- Map prod, email, backups, logs, third parties.
- Add clauses or measures for any link outside adequacy.
- Compare via the directory if strict EU constraint applies.
See transfers outside the EU for general framing.
Frequently asked questions
Does a Swiss host imply a transfer outside the EU?
Yes for a controller established in the EU. Adequacy eases the framework; DPA and documentation remain mandatory.
Is the adequacy decision enough alone?
No. It replaces SCCs to Switzerland under conditions, without removing register, DPA, and sub-processor analysis.
When are standard clauses still required?
Whenever a sub-processor processes outside Switzerland/EEA or a flow escapes adequacy.
Does it fit EU-only projects?
Often not without documented exception: Switzerland is outside the EEA. Prefer an EU host if the spec forbids it.
Before approving Switzerland, ask: which document proves only authorised flows leave the EEA?