# Iceland or Switzerland: which has stronger privacy laws for hosting?

> Iceland or Switzerland for privacy hosting? GDPR via the EEA vs the revised FADP: fines, regulators and EU data flows compared. Ravenquay: no KYC, crypto.

- URL: https://ravenquay.com/iceland-vs-switzerland-privacy-hosting/
- Last updated: 2026-11-01
- Publisher: Ravenquay (https://ravenquay.com)

Two data-protection regimes outside the EU, line by line: the law, the regulator, the penalties, breach rules and data flows with the EU.

**Quick answer — Iceland or Switzerland: which has stronger privacy laws for hosting?**

Iceland or Switzerland: on enforcement, Iceland's privacy law is stronger. It applies the GDPR, and its regulator can fine a company up to ISK 2.4 billion or 4% of turnover. Swiss fines reach CHF 250,000, through cantonal criminal courts. Both have independent regulators and free data flows with the EU. **Ravenquay** rents servers in both from $72.62 per 30 days, with no KYC and payment in crypto.

## How do Iceland's and Switzerland's privacy laws compare?

|  | Iceland | Switzerland |
| --- | --- | --- |
| Main law | Act No. 90/2018, which applies the GDPR | Federal Act on Data Protection (FADP), SR 235.1 |
| In force | 15 July 2018 | 1 September 2023 (revised act) |
| Place in Europe | EEA state, not an EU member | Outside the EU and the EEA |
| Data flows with the EU | Free, inside the EEA single market | Free, under EU adequacy Decision 2000/518/EC, kept in place on 15 January 2024 |
| Regulator | Persónuvernd: board of five, takes no instructions | FDPIC: elected by the United Federal Assembly, takes no instructions |
| Who imposes fines | Persónuvernd, as administrative fines | Cantonal criminal authorities |
| Highest fine | ISK 2.4 billion, or 4% of global annual turnover if higher | CHF 250,000 on the person responsible; CHF 50,000 on a business in limited cases |
| Prison terms in the data act | Up to 3 years for a serious, intentional offence for profit | None: the FADP's penalty articles set fines |
| Breach notice to the regulator | Within 72 hours where feasible (GDPR Article 33) | As quickly as possible, if a high risk is likely (FADP Article 24) |
| Hosts selling servers there, 30 October 2026 | 7 of 34 | 10 of 34 |
| Ravenquay Harbor 8 | $72.62/30 days | $72.62/30 days |

Laws read on official sites on 1 November 2026; the sources are listed at the bottom of this page. Both English translations are published for information only.

## Which country has the higher penalties?

Iceland, by a wide margin. Act No. 90/2018 lets Persónuvernd fine a company up to ISK 1.2 billion or 2% of global turnover for duties like security and records. For core principles, people's rights and transfers, the ceiling is ISK 2.4 billion or 4% (Article 46). The Act adds prison terms of up to three years for serious, intentional offences committed for profit (Article 48).

Switzerland chose another model. Its FADP fines the responsible person, not the company, up to CHF 250,000 for wilful breaches (Articles 60 to 63). A business pays instead, up to CHF 50,000, only where finding the person would be disproportionate (Article 64). The cantons prosecute (Article 65).

**Iceland's ceiling is a share of turnover; Switzerland's is a fixed sum aimed at a person.**

## Which data protection regulator is more independent?

Both are independent by statute, through different routes.

- **Persónuvernd (Iceland).** The Act calls it an independent body that takes no instructions (Article 38). A minister appoints a board of five for five-year terms. Its chair and deputy must qualify as district court judges. No other authority hears appeals against its decisions; the courts remain open.
- **FDPIC (Switzerland).** The United Federal Assembly elects the Commissioner, who acts without instructions from any authority or third party (Article 43). The office has its own budget and staff. It can order processing stopped and data deleted, and can ban a disclosure abroad (Article 51).

Neither statute gives its regulator a clear edge in independence. The real difference is the power to fine, covered above.

## Which is better for data flows with the EU?

Neither creates friction. Iceland sits inside the EEA, and its act aims at the free flow of personal data within the EEA single market (Article 1). The GDPR applies there as incorporated into the EEA Agreement (Article 2).

Switzerland sits outside, but the European Commission found its protection adequate in Decision 2000/518/EC. The Commission's review of 15 January 2024 kept that decision in place. In the other direction, Annex 1 of the Swiss Data Protection Ordinance lists Iceland and every EU state as adequate.

**For EU data, a server in Reykjavik and a server in Zurich are equally open doors.**

## Do the two laws protect the same data?

Mostly. Both protect the data of natural persons, not information about companies as such. Iceland's act repeats the GDPR definition of personal data (Article 3). The FADP defines it as information about an identified or identifiable natural person (Article 5).

The sensitive lists differ at the edges. The Swiss list names data on administrative and criminal proceedings and on social assistance measures. Iceland's list follows the GDPR: origin, opinions, beliefs, union membership, health, sex life and genetic data among others.

The Swiss Constitution adds a direct right to protection against misuse of personal data (Article 13). What you read here is general information on the law, not legal advice.

## What about data retention and surveillance?

Retention rules for both countries are compared on [which European countries still have data retention laws](https://ravenquay.com/data-retention-laws-europe/ "Data retention laws in Europe, country by country"). On the Swiss side, the surveillance act (SPTA) makes telecom service providers keep secondary telecommunications data for 6 months (Article 26). Providers of derived communications services must hand over the data they hold on request (Article 27).

How that applies to hosting is set out on [does Switzerland have a data retention law for hosting providers](https://ravenquay.com/switzerland-data-retention-law/ "Swiss retention duties for hosting providers").

Whatever the country, Ravenquay's own rule is the same: We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers.

## Should I host in Iceland or in Switzerland?

Choose by the law you want to answer to:

- **Reykjavik** if your users are in the EEA and you want the GDPR itself, with turnover-based fines and an independent regulator. Iceland's electricity was also almost entirely renewable in 2015, about 73% hydro and 27% geothermal, per its government.
- **Zurich** if you prefer a law written outside the EU, with EU adequacy, fines aimed at individuals and a constitutional data right.

**Of 34 dedicated-server hosts checked on 30 October 2026, 10 sell servers in Switzerland but only 7 in Iceland.** At Ravenquay the choice costs nothing: Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price.

Each country has its own page: [Iceland as a hosting location](https://ravenquay.com/offshore-hosting-iceland/ "Iceland: GDPR through the EEA and Persónuvernd") and [Switzerland for privacy hosting](https://ravenquay.com/switzerland-privacy-hosting/ "Switzerland: the revised FADP and the FDPIC"). The company behind both is covered on [Panama as a hosting jurisdiction](https://ravenquay.com/panama-hosting-jurisdiction/ "What a Panama registration means for a host").

## What does a server cost in Reykjavik or Zurich?

Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25, each per 30 days, in either city. There is no setup fee: you pay the price of your chosen term, both when you order and when you renew. Once the network has confirmed your coins, expect your server within minutes; one hour is the ceiling. The dashboard tracks its status until the IP address appears.

You pay in BTC, USDT, USDC, ETH, SOL, LTC, XMR, from a $1 top-up. Terms and discounts are on [how much a Ravenquay server costs](https://ravenquay.com/pricing/ "Ravenquay berths, terms and prices").

## Which berth fits my project?

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Harbor 8 | 8 cores · unmetered 1 Gbit/s | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |
| Harbor 16 | 16 cores · unmetered 1 Gbit/s | $205.27 | $554.22 (−10%) | $985.29 (−20%) | $1,724.26 (−30%) |
| Harbor 10G | 24 cores · unmetered 10 Gbit/s | $356.25 | $961.87 (−10%) | $1,710 (−20%) | $2,992.50 (−30%) |

In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## Iceland vs Switzerland privacy: common questions

### Does the GDPR apply in Switzerland?

Switzerland is outside the EU and the EEA and applies its own Federal Act on Data Protection, in force since 1 September 2023. The EU recognises it as adequate, so data flows from the EU without extra safeguards.

### Does the GDPR apply in Iceland?

Yes. Iceland is not in the EU, but Act No. 90/2018 applies the GDPR as incorporated into the EEA Agreement. Persónuvernd enforces it.

### Which country fines privacy breaches more heavily?

Iceland. Its regulator can fine a company up to ISK 2.4 billion or 4% of global turnover. Swiss fines reach CHF 250,000 and target the responsible person.

### Can I move a server's data from Zurich to Reykjavik?

Under Swiss law, yes: Iceland is on the Federal Council's list of countries with adequate protection. Ravenquay sells each berth in both cities at the same price.

### Is Ravenquay cheaper in one of the two countries?

No. Reykjavik (Iceland), Zurich (Switzerland), Bucharest (Romania) and Amsterdam (Netherlands): every berth in every port of call, at one price.

**Pick your law: Reykjavik or Zurich** Same berths, same price, from $72.62 per 30 days. No KYC, paid in crypto. [Harbor 8 in Reykjavik](https://ravenquay.com/app/checkout/?plan=harbor-8&location=is-rkv&lang=en) · [Harbor 8 in Zurich](https://ravenquay.com/app/checkout/?plan=harbor-8&location=ch-zrh&lang=en)

## Sources

1. [Act on Data Protection and the Processing of Personal Data, No 90 of 27 June 2018 (English translation)](https://assets.ctfassets.net/8k0h54kbe6bj/7In0DivFbWLMnjfAl69CC0/feadbca7a134729218ad456eaf2832c3/English%5Ftranslation%5Fof%5Fthe%5FIcelandic%5FAct%5Fon%5FData%5FProtection%5Fand%5Fthe%5FProcessing%5Fof%5FPersonal%5FData%5Fnow%5Favailable-0) — Persónuvernd (Icelandic Data Protection Authority) (read 2026-11-01)
2. [Federal Act on Data Protection (Data Protection Act, FADP) of 25 September 2020, SR 235.1](https://www.fedlex.admin.ch/eli/cc/2022/491/en) — Swiss Confederation, Fedlex (read 2026-11-01)
3. [Ordinance on Data Protection (DPO), SR 235.11, Annex 1](https://www.fedlex.admin.ch/eli/cc/2022/568/en) — Swiss Confederation, Fedlex (read 2026-11-01)
4. [Federal Constitution of the Swiss Confederation, SR 101, Article 13](https://www.fedlex.admin.ch/eli/cc/1999/404/en) — Swiss Confederation, Fedlex (read 2026-11-01)
5. [Federal Act on the Surveillance of Post and Telecommunications (SPTA), SR 780.1](https://www.fedlex.admin.ch/eli/cc/2018/31/en) — Swiss Confederation, Fedlex (read 2026-11-01)
6. [Regulation (EU) 2016/679 (General Data Protection Regulation), Article 33](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) — EUR-Lex, Publications Office of the European Union (read 2026-11-01)
7. [Commission Decision 2000/518/EC on the adequate protection of personal data provided in Switzerland](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32000D0518) — EUR-Lex, Publications Office of the European Union (read 2026-11-01)
8. [Commission finds that EU personal data flows can continue with 11 third countries and territories](https://ec.europa.eu/commission/presscorner/detail/en/ip_24_161) — European Commission (read 2026-11-01)
9. [Energy](https://www.government.is/topics/business-and-industry/energy/) — Government of Iceland (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.