Five forms almost every Swiss SME needs

Most small businesses in Switzerland get by with a manageable number of forms. A joinery in Sursee has a contact form on its website, a quote request for kitchens and fitted cupboards, an occasional registration for the open workshop day, a job application form when the apprenticeship comes up, and, since last year, a short feedback form sent out after an installation. Five forms. Together they are the route by which almost all personal data enters the business.

The five differ more than they look: different purposes, different details, different lifespans for the answers. What they have in common is how they come into being. You think of the first field, and the rest arrive from memories of other forms. That is exactly where the fields come from that contribute nothing to the purpose and still collect answers for years.

The yardstick fits in a single sentence. Art. 6 para. 3 FADP: personal data may be collected only for a specific purpose that is evident to the data subject, and it may be processed only in a way that is compatible with that purpose. So a field belongs to a purpose, not to a form.

1. The contact form

What it is for. Someone has a question and would like an answer. Nothing more.

What carries the purpose. A name or a form of address, a way back, the question. Three fields. If the business calls back rather than writes, the phone number is the way back and the email address is surplus — not both the other way round.

What is added out of habit. The postal address. It sits on almost every contact form and is rarely needed in practice, because an enquiry is not followed by a delivery. Then the company name as a required field, which shuts out private individuals, and the “Subject” dropdown that exists only because it was available while building.

What happens to the answers afterwards. They land in a mailbox and stay there. The contact form is the form with the longest unintended retention period of them all, because nobody tidies a mailbox. Art. 6 para. 4 FADP requires personal data to be destroyed or anonymised as soon as it is no longer necessary for the purpose of processing — for a question that has been answered, that moment is often earlier than the mailbox suggests.

The contact form is subject, like all the others, to the duty to inform under Art. 19 FADP: whoever collects personal data informs the data subject of at least the identity and contact details of the controller, the purpose of processing, and where applicable the recipients or categories of recipients.

2. The quote request

What it is for. The business should be able to name a figure without driving out first.

What carries the purpose. Here it gets technical. For the joinery: the type of work, the room dimensions, the material, the rough time frame, the floor and whether there is a lift, and above all a photo upload. A picture of the room answers in three seconds what a text field takes three follow-up emails to settle. Plus a name, a way back and the address of the property — which here genuinely belongs to the purpose, because the journey feeds into the price.

What is added out of habit. The date of birth. It appears on a surprising number of quote forms and contributes nothing to calculating a price. The same goes for marital status and a field for “Occupation”. And the question about budget, which is not a detail about the property but one about the person.

What happens to the answers afterwards. Some enquiries become a job; the rest become nothing. From that moment the two halves have nothing to do with each other: one turns into contract and accounting records with deadlines of their own, the other is an enquiry that has been dealt with. In the spreadsheet they usually sit side by side until the end of days.

3. Registering for a course or event

What it is for. The business knows who is coming and can reach the participants if something changes.

What carries the purpose. A name, a way back, the session chosen, the number of people. For an event with catering, a choice of meal type. For a children’s course, an emergency number.

What is added out of habit. The full home address for an event everyone travels to themselves. The date of birth where only a minimum age matters — for that, the statement that it has been reached is enough. And the “Allergies and intolerances” field when nothing is served at all: the list then holds a detail about health for which there is no purpose. The FADP counts data on health among the sensitive personal data in Art. 5 let. c no. 2, and the requirements for consent under Art. 6 para. 7 let. a FADP attach to that classification, among other things.

What happens to the answers afterwards. The event takes place, and the list stays. It gets opened again next year because “the people from last time” are in it. With that the purpose shifts from running the event to marketing — a different purpose from the one the details were collected for.

The same form exists without a business behind it: a private individual organising a tournament, a neighbourhood party or a group order builds the same thing field by field.

4. The job application form

This form sits in a frame of its own. Art. 328b of the Code of Obligations provides that an employer may process data concerning an employee only to the extent that it concerns the employee’s suitability for the employment relationship or is necessary for the performance of the employment contract. According to Art. 362 CO, this provision may not be departed from to the employee’s detriment, not even with their agreement.

What carries the purpose. A name, a way back, the position applied for, education and career history, the documents as an upload. The FDPIC states that employers may ask applicants only for the details that show whether they meet the requirements of a position, and that questions about education, career history and career prospects are as a rule permitted.

What is added out of habit. Here the list is longest, because the job application form is the form with the strongest tradition.

Field	How it relates to suitability
Photo	According to the FDPIC, a picture can allow inferences about characteristics such as religion, race or physical impairments. About professional suitability it says nothing.
Date of birth	It is needed to perform the employment contract; for the selection beforehand, as a rule it is not.
Nationality, origin	Questions about origin are, according to the FDPIC, permitted only where they are imperative given the ideology of the business. Whether a work permit exists is a separate question.
Marital status, children	Concerns performance of the contract, not the selection.
Health, pregnancy	According to the FDPIC, the employer may not enquire about an applicant’s health directly; it may request a medical opinion on suitability for the position.
Criminal record extract	Only for positions of trust or where valuables are handled; the FDPIC states that no legitimate interest justifies a systematic check.
Religion, memberships	Permitted only where they are imperative given the ideology of the business.

What happens to the answers afterwards. The selection process ends, and for the rejected applications something begins that most form builders have not planned for. The FDPIC describes it this way: once the selection process is complete, the documents of rejected applicants must be returned and any copies must in principle be destroyed, subject to a justification; with the applicant’s agreement, retention until a date fixed in advance is conceivable. An online application form knows no returning. With it, the pile is a list, and “returning” means deleting — in every place the documents have since come to rest.

The FDPIC also names who may look at the documents: as a rule the HR department or the direct line managers. In a business with eight employees that is not a department but a person — a decision a shared mailbox does not make on its own.

5. The feedback or complaint form

What it is for. The business finds out what is not right and can do something about it.

What carries the purpose. Remarkably little: what it is about, and a way back if an answer is wanted. For a complaint, the reference to the job is added — order number or date — because otherwise nothing can be traced.

What is added out of habit. The name as a required field on feedback that would be just as usable anonymously. The five-point rating scale across six dimensions that nobody evaluates. And the question about age, which at a bicycle workshop in Biel says nothing about the quality of the repair.

What happens to the answers afterwards. Complaints get passed on. This is exactly where Art. 19 para. 2 let. c FADP is worth a look, which counts the recipients or categories of recipients among the minimum information. If feedback about an installation ends up with the supplier of the fittings, the supplier is a recipient.

Two questions that sit side by side

Many of these forms end with two optional questions that look alike and differ fundamentally.

“How did you hear about us?” is a question about the business. The possible answers are known before anyone has answered: search engine, recommendation, shop window, advertisement. They can be counted, they can be summarised, and they say nothing about the person answering that they have not said anyway.

“Is there anything else we should know?” is a question about the person, and one without a boundary. What arrives in it is decided not by the business but by the mood of the person answering that evening. This is not a free-text problem as such — the “Describe the work” field in the quote request is free text too and does not raise it. The difference lies in the question: one bounds what counts as a fitting answer, the other does not. A field whose content is undetermined in advance cannot be measured against the purpose beforehand, because the purpose is only settled once the answer has arrived.

What the five have in common

Three things recur in all five.

The label decides part of what arrives. The W3C’s WCAG 2.2 lists this as success criterion 3.3.2, Labels or Instructions: labels or instructions are provided when content requires user input. A field called “Comments” and a field called “Which fittings are installed?” are technically the same text box and take in entirely different things.

Asking the same thing twice is a topic of its own. Success criterion 3.3.7, Redundant Entry, requires that information previously entered by the user and required to be entered again in the same process is either auto-populated or made available for the user to select. Where the same detail is typed twice, it ends up in the results twice as well, sometimes spelled differently.

The purpose ends at different moments. An answered enquiry is done, a job turns into records with deadlines of their own, a rejected application has an end point the FDPIC describes, and a participant list outlives the event only as long as there is a reason for it. Five forms are therefore five deletion decisions and not one.

Printing out the five forms of your own business and writing beside each field, in one sentence, what the answer is needed for puts the review behind you in half an hour. The fields where the sentence does not come together are usually the ones that arrived from a memory of another form.

With Forms we are building a web app for exactly these five: forms whose answers are encrypted in the respondent’s browser and stay stored in Switzerland. Which fields they contain remains the decision of whoever sets the form up — no software changes that.