Does Switzerland have a data retention law for hosting providers?

What does Swiss law make telecom providers keep?

Metadata and identification data, for 6 months. The surveillance act (SPTA) lists six kinds of entities that must cooperate. Telecommunications service providers carry the heaviest duties.

• Traffic metadata: Article 26(5) makes them keep the "secondary telecommunications data" of communications for 6 months.
• Subscriber data: Article 21 makes them record it when a contract starts and keep it until 6 months after it ends.
• IP assignments: Article 21(3) of the ordinance adds the unique assignment of IP addresses at the network access point, kept 6 months.
• Encryption: Article 26(2)(c) makes them remove any encryption they applied themselves. Encryption a customer applies is not theirs to remove.

The Telecommunications Act defines a telecommunications service as the transmission of information for third parties by telecommunications techniques (Article 3(b)).

Is a Swiss hosting provider a telecom provider or a derived service?

It depends on what it supplies. The act defines derived communications services as services based on telecommunications services that enable one-way or multipath communication (Article 2(c)). It has no rule written for hosting.

The Federal Department of Justice and Police wrote its own reading into the explanatory report of 8 January 2025, prepared for the draft revision:

• Online storage, such as cloud storage and file hosting, is a derived communications service.
• A hosting provider that also supplies internet access to the server is a telecom provider for that access.
• Cloud computing with neither internet access nor a communications service for third parties is neither.

That report explains a draft, not the law in force. Under the act, the retention duty follows the network service, not the storage.

What must a derived communications service hand over?

What it already holds. Under Article 27 of the act, such a provider must tolerate surveillance of the data a target transmits or stores through it. It must grant access to its facilities and supply the metadata available to it.

The retention duty comes only with a ruling by the Post and Telecommunications Surveillance Service (PTSS). The ordinance sets the triggers:

• Wider surveillance duties (Article 52): orders on 10 targets in 12 months, or CHF 100 million Swiss turnover two years running plus 5,000 subscribers.
• Wider information duties (Article 22): 100 information requests in 12 months, or the same turnover test.

A provider with wider surveillance duties must keep IP and NAT assignment data for 6 months (Article 21(6)).

Is the Swiss data protection act a retention law?

No. Switzerland's Data Protection Act, revised with effect from 1 September 2023, governs how personal data is processed. Search results for Swiss data retention often answer with it.

Retention for criminal investigations comes from the surveillance act and its ordinance. They decide who keeps metadata, for how long, and who may read it.

This page summarises published Swiss law; it is not legal advice.

What is changing in the 2025–2026 revision?

The ordinance may widen, but nothing is adopted. The Federal Council opened a consultation on a partial revision on 29 January 2025.

On 11 February 2026 it took note of the consultation results. An external firm is assessing the cost to the companies affected. A second consultation will open once a final draft exists. Motions 25.4206 and 25.4273 ask the Federal Council to rework the drafts, and it proposed accepting both.

The surveillance service's press page, read on 1 November 2026, announces no second consultation yet. Its scope and date remain unclear.

How do foreign police reach data on a Swiss server?

Through Swiss authorities. Under the Mutual Assistance Act (IMAC), Swiss searches or seizures for a foreign case require an act that is a Swiss offence too (Article 64). Swiss law governs how they are carried out.

Switzerland has applied the Budapest Convention on Cybercrime since 1 January 2012. The full path is on can police seize my server in another country.

What does Ravenquay keep about a Zurich server?

Only billing and server records. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country. In Zurich, Swiss law governs the datacenter and the network operator that carries the server's traffic.

Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 10 offered machines in Switzerland, against 19 in the Netherlands. Iceland is weighed against Switzerland on Iceland or Switzerland for privacy hosting. The full country table is on which European countries still have data retention laws.