Must I comply with the EU GDPR as a coach based in Switzerland?

Yes, in most cases. As soon as you work with a client from the EU, or your website targets the European market (for example with prices in euros), the GDPR applies. An integrated system covers most of the requirements automatically.

Is Zoom GDPR-compliant for coaching sessions?

It is often a grey area. Because Zoom processes data in the US (a third country), you need additional legal agreements. The safe option is integrated video sessions, encrypted and hosted directly in Europe.

What exactly is a Record of Processing Activities?

It is an internal document for your legal certainty. Among other things, you record in it which data you keep in your CRM system.

Can I store session notes purely on my private laptop?

Only under very strict security conditions. Storing them in a secure, cloud-based CRM is far safer and compliant with data protection law.

Is the software platform liable for data protection if I host everything there?

An all-in-one platform provides the compliant infrastructure and is liable for secure hosting. As a coach, you naturally remain responsible for the content of your private notes.

Data Protection in Coaching: GDPR and Swiss FADP Compliance for Coaches in 2026

As a coach, you handle your clients' most private information every day: psychological blocks, relationship problems, health limitations, money worries. That is exactly why coaches sit squarely within the scope of the revised Swiss Federal Act on Data Protection (revFADP) and the EU General Data Protection Regulation (GDPR).

Many Swiss coaches assume one of two things: "My clients are all in Switzerland, so the EU GDPR doesn't concern me," or "That only applies to big corporations."

Both are wrong. One unencrypted email thread containing sensitive health data, or one insecure Zoom connection, can lead to heavy fines and lasting damage to your reputation. This guide shows you what to watch for, and how modern coaching platforms take that risk off your hands.

The most dangerous data protection traps in day-to-day coaching

WhatsApp and unencrypted email

Do you use WhatsApp to book appointments or for quick check-ins between sessions? WhatsApp belongs to Meta, its servers are in the US, and the metadata it shares is legally unacceptable for highly sensitive coaching conversations. Sending detailed session notes or worksheets by ordinary, unencrypted email (Gmail or Bluewin, say) is just as careless.

The solution: For asynchronous communication, use a closed, encrypted client portal that keeps every message inside a secured server.

Zoom, Skype and "free" video tools

Zoom became the default during the pandemic. From a data protection point of view it was problematic then, and in part it still is, mainly because of data transfers to the US. As a coach, you need a video solution with genuine end-to-end encryption, ideally running on servers in Switzerland or the EU.

The solution: Dedicated live session environments, hosted on European servers specifically for confidential 1:1 conversations, make sure nobody can listen in (or record).

Local notes vs. cloud storage

You write everything by hand? Legally that is fine, as long as the notepad goes into a safe every evening. It just doesn't scale. Do you keep your Word notes on Google Drive or Apple iCloud? Then, strictly speaking, you need a data processing agreement (DPA) with Google or Apple. Do you have one? Probably not.

The solution: A closed coaching CRM, where client profiles and notes are stored with cryptographic encryption in secured databases.

The privacy policy: the mandatory part

Your website must have a privacy policy. You can't simply copy one from a colleague, because it has to reflect exactly which tools you use. Who hosts your site? Which newsletter tool do you run? Google Analytics?

You also have to keep a "record of processing activities". This is an internal document where you write down exactly where you store which client data, and when you delete it.

If you process health data (which happens quickly in life coaching, for example once burnout comes up), the revFADP applies considerably stricter rules.

The safest way out: the platform solution

Here is the uncomfortable truth. If you are a sole trader trying to build compliant infrastructure out of a stack of American tools, you will always have one foot in a legal grey zone. Tying Zapier, Calendly, a payment provider, Zoom and Google Workspace together with proper data protection agreements takes an enormous amount of work.

This is where all-in-one platforms like bondigoo earn their keep, and it is often underestimated: you hand off the compliance risk and the technical burden.

Instead of checking five different licences and server locations, you work inside one fully closed system:

Centralised data storage: Everything, from highly sensitive session notes to scheduling and asynchronous messages, stays inside one closed infrastructure that is legally sound in Switzerland and the EU.
Built-in video room: Live sessions happen directly in the system. No more external Zoom links sending data to the US.
Automated consent to terms: New clients have to actively accept the privacy terms at checkout. Their consent is stored digitally, which protects you if legal questions come up later.
Payments via escrow: Financial data such as card details travels through certified, highly secure escrow systems. You never have to store a client's sensitive bank details on your own laptop.

Data protection doesn't have to frighten coaches anymore. If you build on standardised, professional infrastructure, you protect your clients' secrets and your own livelihood at the same time. On exactly that basis you can get started as a coach on bondigoo without patching together a legal quilt of separate tools.

Read also: Coaching Contract Switzerland: Template, Clauses and Legal Foundations and Video Coaching Tools 2026: Security, Encryption, and the GDPR Trap

Hand off your data protection risk and coach safely on bondigoo