# Does Switzerland have a data retention law for hosting providers?

> Does Switzerland have a data retention law for hosting providers? Telecom providers keep 6 months of metadata. Ravenquay: Zurich servers, no KYC, crypto.

- URL: https://ravenquay.com/switzerland-data-retention-law/
- Last updated: 2026-11-02
- Publisher: Ravenquay (https://ravenquay.com)

Who the Swiss surveillance act makes keep what, where hosting fits in its categories, the 2026 revision, and what Ravenquay holds in Zurich.

**Quick answer — Does Switzerland have a data retention law for hosting providers?**

Yes, but it is aimed at telecom providers. Switzerland's surveillance act (BÜPF/LSCPT) makes telecommunications service providers keep traffic metadata for 6 months. A host that is only a derived communications service hands over what it holds. It keeps data once regulators declare it a larger provider. **Ravenquay** offers Zurich servers from $72.62 for 30 days, with no KYC and payment in crypto.

## Swiss data retention law: the facts, read on 1 November 2026

| Attribute | Value |
| --- | --- |
| Statute | Federal Act on the Surveillance of Post and Telecommunications (BÜPF / LSCPT / SPTA), SR 780.1, status 1 September 2023 |
| Ordinance | Ordinance on the Surveillance of Post and Telecommunications (VÜPF / OSCPT / SPTO), SR 780.11, status 26 March 2024 |
| Traffic metadata | Telecommunications service providers keep it for 6 months (SPTA Article 26(5)) |
| IP address assignments | Telecommunications service providers keep them for 6 months (SPTO Article 21(3)) |
| Derived communications services | Supply the data they hold (SPTA Article 27(2)); retention only after a ruling on wider duties |
| Threshold for wider duties | 10 surveillance targets in 12 months, or CHF 100 million Swiss turnover two years running with 5,000 subscribers (SPTO Article 52) |
| Pending revision | Consultation 2025; second consultation planned (Federal Council, 11 February 2026) |
| Ravenquay in Zurich | We keep no logs at all: no connection records, no traffic records and no IP addresses of visitors or customers, whether on the website, in the dashboard or on the servers |

## What does Swiss law make telecom providers keep?

Metadata and identification data, for 6 months. The surveillance act (SPTA) lists six kinds of entities that must cooperate. Telecommunications service providers carry the heaviest duties.

- **Traffic metadata:** Article 26(5) makes them keep the "secondary telecommunications data" of communications for 6 months.
- **Subscriber data:** Article 21 makes them record it when a contract starts and keep it until 6 months after it ends.
- **IP assignments:** Article 21(3) of the ordinance adds the unique assignment of IP addresses at the network access point, kept 6 months.
- **Encryption:** Article 26(2)(c) makes them remove any encryption they applied themselves. Encryption a customer applies is not theirs to remove.

The Telecommunications Act defines a telecommunications service as the transmission of information for third parties by telecommunications techniques (Article 3(b)).

## Is a Swiss hosting provider a telecom provider or a derived service?

It depends on what it supplies. The act defines derived communications services as services based on telecommunications services that enable one-way or multipath communication (Article 2(c)). It has no rule written for hosting.

The Federal Department of Justice and Police wrote its own reading into the explanatory report of 8 January 2025, prepared for the draft revision:

- Online storage, such as cloud storage and file hosting, is a derived communications service.
- A hosting provider that also supplies internet access to the server is a telecom provider for that access.
- Cloud computing with neither internet access nor a communications service for third parties is neither.

That report explains a draft, not the law in force. **Under the act, the retention duty follows the network service, not the storage.**

## What must a derived communications service hand over?

What it already holds. Under Article 27 of the act, such a provider must tolerate surveillance of the data a target transmits or stores through it. It must grant access to its facilities and supply the metadata available to it.

The retention duty comes only with a ruling by the Post and Telecommunications Surveillance Service (PTSS). The ordinance sets the triggers:

- **Wider surveillance duties (Article 52):** orders on 10 targets in 12 months, or CHF 100 million Swiss turnover two years running plus 5,000 subscribers.
- **Wider information duties (Article 22):** 100 information requests in 12 months, or the same turnover test.

A provider with wider surveillance duties must keep IP and NAT assignment data for 6 months (Article 21(6)).

## Is the Swiss data protection act a retention law?

No. Switzerland's Data Protection Act, revised with effect from 1 September 2023, governs how personal data is processed. Search results for Swiss data retention often answer with it.

Retention for criminal investigations comes from the surveillance act and its ordinance. They decide who keeps metadata, for how long, and who may read it.

This page summarises published Swiss law; it is not legal advice.

## What is changing in the 2025–2026 revision?

The ordinance may widen, but nothing is adopted. The Federal Council opened a consultation on a partial revision on 29 January 2025.

On 11 February 2026 it took note of the consultation results. An external firm is assessing the cost to the companies affected. A second consultation will open once a final draft exists. Motions 25.4206 and 25.4273 ask the Federal Council to rework the drafts, and it proposed accepting both.

The surveillance service's press page, read on 1 November 2026, announces no second consultation yet. Its scope and date remain unclear.

## How do foreign police reach data on a Swiss server?

Through Swiss authorities. Under the Mutual Assistance Act (IMAC), Swiss searches or seizures for a foreign case require an act that is a Swiss offence too (Article 64). Swiss law governs how they are carried out.

Switzerland has applied the Budapest Convention on Cybercrime since 1 January 2012. The full path is on [can police seize my server in another country](https://ravenquay.com/can-police-seize-my-server-abroad/ "How a server abroad gets seized").

## What does Ravenquay keep about a Zurich server?

Only billing and server records. No logs: neither connection nor traffic records, no IP address of any visitor or customer, and no trace of how you found the site apart from a referral code if your link had one. We hold only what billing and operating your server need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per server its name, plan, term, location, system, SSH public key, IP addresses and dates, as well as the temporary root password we set when you gave no key, which no longer opens the server once you change it. We have no control over the datacenter’s network equipment. We hand over records only when a Panamanian court orders it.

Ravenquay belongs to DomaineGoat LLC, a company incorporated in Panama that answers to Panamanian law alone. The datacenter holding each server operates under the law of its own country. In Zurich, Swiss law governs the datacenter and the network operator that carries the server's traffic.

**Ravenquay checked 34 dedicated-server hosts on 30 October 2026: 10 offered machines in Switzerland, against 19 in the Netherlands.** Iceland is weighed against Switzerland on [Iceland or Switzerland for privacy hosting](https://ravenquay.com/iceland-vs-switzerland-privacy-hosting/ "Iceland vs Switzerland privacy laws for hosting"). The full country table is on [which European countries still have data retention laws](https://ravenquay.com/data-retention-laws-europe/ "European data retention laws compared").

## Which Ravenquay berth fits a Zurich server?

One price in all four ports of call: Harbor 8 $72.62, Harbor 16 $205.27, Harbor 10G $356.25 per 30 days. Terms are on [how much a Ravenquay unmetered server costs](https://ravenquay.com/pricing/ "Ravenquay berths and prices").

| Plan | Quantity | 30 days | 3 months | 6 months | 1 year |
| --- | --- | --- | --- | --- | --- |
| Harbor 8 | 8 cores · unmetered 1 Gbit/s | $72.62 | $196.07 (−10%) | $348.57 (−20%) | $610 (−30%) |
| Harbor 16 | 16 cores · unmetered 1 Gbit/s | $205.27 | $554.22 (−10%) | $985.29 (−20%) | $1,724.26 (−30%) |
| Harbor 10G | 24 cores · unmetered 10 Gbit/s | $356.25 | $961.87 (−10%) | $1,710 (−20%) | $2,992.50 (−30%) |

In every plan: Unmetered port · Tor exits allowed · RAID 1 · Dedicated IPv4 · No logs · No KYC

**Before you pay**

- Minimum top-up $1. Top up once in crypto, then buy any plan from your balance.
- Credit on your balance does not expire and renews any of your servers. When a top-up is only made to reach the minimum, the unspent part comes back on request within 30 days of payment, in USDT or USDC. The rest of a balance is not paid out unless the law requires it.
- Credited once your payment is checked on the blockchain. Typical network confirmation time: BTC ≈ 20 min · USDT TRC-20 ≈ 1 min · USDT ERC-20 ≈ 5 min · USDC ERC-20 ≈ 5 min · ETH ≈ 5 min · SOL ≈ 1 min · LTC ≈ 15 min · XMR ≈ 20 min

## Swiss data retention for hosts: common questions

### How long do Swiss telecom providers keep metadata?

Six months. Article 26(5) of the surveillance act sets the period for secondary telecommunications data. IP address assignments at the network access point are also kept 6 months under Article 21(3) of the ordinance.

### Do the EU court's data retention rulings apply in Switzerland?

No. They interpret EU directives, and Switzerland sits outside the EU and the EEA. Swiss retention follows the surveillance act, which the Federal Assembly passed on 18 March 2016.

### Can Swiss law force a provider to decrypt my data?

The act makes telecom providers remove encryption they applied themselves (Article 26(2)(c)). It sets no such duty for encryption that you apply on your own server.

### Is the 2025 VÜPF revision in force?

No. On 11 February 2026 the Federal Council took note of the consultation results and planned a second consultation. The ordinance in force is the version with status 26 March 2024.

**Rent a Zurich server that keeps no logs** Harbor 8 in Zurich costs $72.62 for 30 days, with an unmetered 1 Gbit/s port. Top up in crypto; no KYC, no documents. [Order Harbor 8 in Zurich](https://ravenquay.com/app/checkout/?plan=harbor-8&location=ch-zrh&lang=en) · [See every berth](https://ravenquay.com/pricing/ "How much does a Ravenquay unmetered server cost?")

## Sources

1. [Federal Act on the Surveillance of Post and Telecommunications (SPTA), SR 780.1, status 1 September 2023](https://www.fedlex.admin.ch/eli/cc/2018/31/en) — Fedlex, Swiss Confederation (read 2026-11-01)
2. [Ordinance on the Surveillance of Post and Telecommunications (SPTO), SR 780.11, status 26 March 2024](https://www.fedlex.admin.ch/eli/cc/2018/32/en) — Fedlex, Swiss Confederation (read 2026-11-01)
3. [Telecommunications Act (TCA), SR 784.10, Article 3](https://www.fedlex.admin.ch/eli/cc/1997/2187_2187_2187/en) — Fedlex, Swiss Confederation (read 2026-11-01)
4. [Federal Act on International Mutual Assistance in Criminal Matters (IMAC), SR 351.1](https://www.fedlex.admin.ch/eli/cc/1982/846_846_846/en) — Fedlex, Swiss Confederation (read 2026-11-01)
5. [Teilrevisionen zweier Ausführungserlasse zur Überwachung des Post- und Fernmeldeverkehrs (VÜPF, VD-ÜPF): Erläuternder Bericht, 8 January 2025](https://www.newsd.admin.ch/newsd/message/attachments/91533.pdf) — Federal Department of Justice and Police (FDJP) (read 2026-11-01)
6. [Fernmeldeüberwachung und mitwirkungspflichtige Unternehmen: Bundesrat nimmt Ergebnis des Vernehmlassungsverfahrens zur Kenntnis (11 February 2026)](https://www.admin.ch/de/newnsb/EXv-JkPBAZuL) — Federal Council (read 2026-11-01)
7. [Medienmitteilungen](https://www.li.admin.ch/de/medien) — Post and Telecommunications Surveillance Service (PTSS) (read 2026-11-01)
8. [Convention on Cybercrime, SR 0.311.43, scope of application as of 19 June 2025](https://www.fedlex.admin.ch/eli/cc/2011/888/fr) — Fedlex, Swiss Confederation (read 2026-11-01)

---

Ravenquay: Ravenquay rents offshore dedicated servers with unmetered 1 and 10 Gbit/s ports in Reykjavik, Zurich, Bucharest and Amsterdam: each one a whole physical machine with root access and no monthly traffic quota, paid in crypto with no KYC (no ID, no selfie, no documents). It is run by DomaineGoat LLC, a company registered in Panama, and each server also falls under the data-protection law of its datacenter's country. On the 30-day term, each berth is priced at least 25% under a named comparable unmetered server from 10 no-KYC crypto hosts, read on 30 October 2026.