Privacy notice: inform people when data are collected

The revised Federal Act on Data Protection requires the controller to inform the data subject when personal data are collected. The information covers at least the controller's identity, the purpose and, where relevant, the recipients and disclosure abroad. A policy posted on a website is not enough if the person is not directed to it at the time of collection, for example in a form. The FDPIC explains the duties. The statute is on Fedlex.