Data Protection and QR Codes: What Swiss Companies Must Consider Under the DSG
QR codes are generally regarded as harmless technical tools—a pattern of black and white squares that links to a website. However, as soon as a code processes data or leads to forms that collect personal information, it enters an area of data protection law that is also relevant for Swiss companies.
Note: This article provides a general overview and is not a substitute for legal advice. If you have specific questions regarding your own situation, it is recommended that you consult a specialist.
The Revised Data Protection Act (revDSG) as the Legal Basis
The revised Data Protection Act (revDSG) has been in effect in Switzerland since September 2023. Among other things, it requires companies to:
- Transparency: Data subjects must be able to understand what data is being processed and for what purpose—usually through a privacy policy.
- Data minimization: Only as much data as is actually necessary for the specific purpose may be collected.
- Appropriate security: Technical and organizational measures must protect the processed data from misuse, loss, or unauthorized access.
- Mandatory reporting of breaches: Certain data breaches must be reported to the Federal Data Protection and Information Commissioner (FDPIC).
Where QR codes specifically come into play
Scan tracking as data processing
If a dynamic QR code tracks when, how often, and via which device it was scanned, this constitutes a form of data processing. If individual scans can potentially be traced back to a specific person via the IP address, this process should be mentioned in your privacy policy—even though many QR code providers already process IP addresses in an anonymized manner, thereby significantly reducing the risk.
Forms and Landing Pages Behind the Code
If a QR code leads to a contact form, a newsletter sign-up, or a contest that requests personal data, the same requirements apply to this landing page as to any other form: There must be clear information about the purpose of use as well as a valid legal basis for processing. In case of doubt, explicit consent is also required.
vCard Codes with Third-Party Contact Information
If a vCard QR code is created not for oneself but for another person (such as for employees on shared name tags), it should be verified whether the data subject consents to the publication of their contact information.
Location Outside Switzerland
If the scanning process or the underlying data processing is handled by a provider with its headquarters or server location abroad, the issue of cross-border data processing may also become relevant. Providers with headquarters and hosting in Switzerland or the EU simplify this assessment considerably in practice.
A Practical Checklist
- Does your privacy policy state that QR code scans may be analyzed for statistical purposes?
- Are IP addresses anonymized or at least truncated during analysis?
- Does a QR code lead to a form that collects personal data—and is this form itself designed in compliance with data protection regulations?
- Is sensitive content or content not intended for the public being distributed via an openly accessible QR code, even though password protection would be more appropriate?
- Is it known where the QR code provider operates its servers?
A pragmatic perspective
For most everyday applications—a menu, a product information code, a link to social media—data protection laws do not pose major hurdles, provided that basic transparency requirements are met. The situation becomes more critical as soon as a QR code leads directly or indirectly to personal data—for example, via a form, a survey with a name field, or a contact card. In these cases, it’s worth doing a quick, thorough check before the code goes to print.
What to Look for When Choosing a QR Code Provider
If you want to ensure your own operations comply with data protection regulations, you should also take a close look at the QR code tool you’re using. Where is the data hosted? Are IP addresses anonymized? And can sensitive content be password-protected if needed? QRown is hosted in Switzerland and anonymizes scan data by default—a solid foundation for fulfilling your data protection obligations with a clear conscience.
Get started today!
Create your QR codes with a Swiss provider that prioritizes data protection from the very beginning.