From a paper form to an online form: what actually changes

A gymnastics club in Sarnen signs up around a hundred and twenty children for its youth classes every year. It has worked the same way for years: in August a stack of registration sheets sits in the hall, parents fill them in at the edge of a training session, the group leader collects them and types them into a spreadsheet over two evenings. Afterwards the sheets live in a ring binder in the cupboard next to the equipment room.

This year the same form is to go online. The question that rarely gets asked is not whether that is possible — it is. It is: what exactly is different afterwards? Part of it is a genuine relief. Part of it is harder than before. And a third part is neither better nor worse; it moves work from one place to another, where nobody used to have it.

The paper route, step by step

Before anything can be compared, it is worth writing out the existing route. It has more stations than it seems to have in everyday use.

The sheet is printed and laid out. Someone takes it home or fills it in on the spot. It comes back — at training, by post, through the club’s letterbox, or not at all. The group leader reads the handwriting, types the details in, and files the sheet in the binder. The binder stands in the cupboard. After a few years it is disposed of, usually through the shredder at the workplace of somebody on the committee.

Two things stand out about this route. First, there is exactly one copy, and everyone knows where it is. Second, there is one step that produces nothing except a second version of the same details: the re-typing.

What gets easier

The re-typing step disappears, and its errors with it. This is the biggest and least spectacular gain. Re-typing produces precisely the errors that are expensive later: a transposed digit in a phone number, a line skipped while scrolling, a name that arrives in the spreadsheet spelled differently from the sheet. Anyone processing personal data has to make sure it is accurate under Art. 6 para. 5 FADP, and to take all appropriate measures so that data that is inaccurate or incomplete in view of the purpose is corrected, deleted or destroyed. One step fewer in the chain is one source of error fewer.

Handwriting stops being a factor. There is no argument about whether the sheet says “Jan” or “Jann”, and no guesswork over the third digit of an emergency number.

The answers sit in one place. On paper they end up in one place too — but only after somebody has carried them there. Online they are in one place from the moment the form is submitted.

A single answer can be found again. That sounds like a convenience, and it is in fact the precondition for something else: under Art. 25 FADP any person may request information as to whether personal data concerning them is being processed, and receives, among other things, the personal data as such, the purpose of the processing, and the retention period or the criteria for determining it. Answering that question once for a single child is half an hour of searching in a binder and a second in a list.

Timing stops mattering. A parent who forgot the sheet on training night fills it in on Sunday. In Switzerland that is a realistic assumption for almost everyone: according to the Federal Statistical Office, in 2025 98 per cent of the population used the internet at least once a week, against a European average of 93 per cent.

The form can check what is entered. A paper form accepts any entry, including an empty one. An online form can point out that the date of birth is missing. The W3C’s WCAG 2.2 describes this case as success criterion 3.3.4: for pages that cause legal commitments or that modify or delete stored data, submissions are either reversible, or checked for input errors with an opportunity to correct them, or available for review, confirmation and correction before they are finalised.

What gets harder

Not everyone gets through equally well. The Federal Statistical Office notes that the distribution of digital skill levels differs sharply by level of education: among people with tertiary education, almost nine in ten have basic or above-basic digital skills, whereas among people without post-compulsory education only one in three does; half of that group has low digital skills and 13 per cent have none at all. In a club with a hundred and twenty families those are not lines in a statistic but a handful of specific parents who ask at the parents’ evening whether the sheet still exists.

The sheet was handed over; the link gets forwarded. A paper form reaches whoever is standing in the hall. A link works for everyone who has it — including those who were sent it by someone else. A form meant to be public has no problem with that; a form intended for one particular group turns out to have relied on paper for its limits, and online that limit is something somebody has to build.

The half-finished registration. On paper it is a sheet that stays in a coat pocket. Online it has either vanished or been stored as a fragment, and both of those are decisions. WCAG 2.2 treats the case as a timing problem: success criterion 2.2.1 requires that a time limit set by the content can be turned off or extended, or that the user is warned before it expires, and the further criterion 2.2.6 requires that users are warned of any period of inactivity that could cause data loss, unless the data is preserved for more than twenty hours.

At the bus stop, on a phone. Some of the registrations will now be made standing up, one-handed, on a small screen. Whether that works depends on details that do not exist on paper at all: WCAG 2.2 names in criterion 2.5.8 a minimum target size of 24 by 24 CSS pixels for pointer inputs, with exceptions for smaller targets that are sufficiently spaced. A tick box on paper is as big as the pen needs it to be.

The wish for a copy on paper. It does not go away. Someone who used to fill in the sheet and keep a copy still wants something in hand — and if the online form shows nothing printable after submission, a gap opens up exactly there where there was none before.

What is simply different

A third group of changes is hard to book as a gain or a loss. It is a shift.

The cupboard and the account. The paper sat behind a cupboard door, and whoever had the key had access. The Data Protection Ordinance knows both and names them separately: confidentiality covers access control to data — authorised persons have access only to the personal data they need to perform their tasks — and access control to the premises and installations where personal data is processed (Art. 3 para. 1 DPO). With a cupboard, one is contained in the other. Online they are two different things, and the access list is something somebody maintains.

Somebody now administers accounts. The youth class leader needs a login. So does the treasurer, though perhaps only for the payment details. In autumn somebody steps down from the committee, and the access has to go again. That step is new: on paper there was never a moment when somebody had to actively withdraw something — the key came back, or the sheet simply stayed where it was.

Availability becomes a property. A binder in a cupboard works during a power cut. The DPO lists availability explicitly as one of four goals of data security — data is to be available when it is needed (Art. 2 let. b DPO) — and requires, among other things, measures so that availability of and access to personal data can be rapidly restored after a physical or technical incident (Art. 3 para. 2 let. d DPO). In practice: on the evening before the registration deadline, the question of what happens if the service is unreachable is a different question from the one the binder posed — not a bigger one, but a new one.

Destroying and deleting are not the same. Under Art. 6 para. 4 FADP personal data is destroyed or anonymised as soon as it is no longer necessary for the purpose of the processing. With the binder that is a trip to the shredder, and afterwards the sheet does not exist. With an online registration the same entry may sit in the database, in a backup, in a notification email and in the spreadsheet somebody downloaded two years ago. The DPO includes the physical side: availability and integrity call for measures so that unauthorised persons cannot read, copy, alter, move, delete or destroy data carriers (Art. 3 para. 2 let. a DPO). Where the answers can end up we went through station by station in a separate post.

The case where paper stays

Not every form gains from the switch. An example from the same club: the sheet consenting to car-sharing for an away match. It is needed twice a year, by twelve families, on the same evening, in the same hall. Nobody re-types it, because nobody uses the details for anything else — it is kept until the event is over and then destroyed. There is no re-typing step to save here, no search that would get faster, and no analysis anyone needs. Online, the same sheet would call for two accounts, a deletion rule and an answer to the question of where it is stored.

The most useful yardstick is therefore not whether a form can be digitised, but what happens to the answers afterwards. Forms whose answers are processed, searched, counted or carried over years gain the re-typing step and the ability to find things. Forms that are read once and then put away mainly gain administration.

We are building Formulare, a web app for the first case: forms whose answers are encrypted in the browser of the person answering and stay stored in Switzerland. It does not decide for anyone which forms should make the move at all — the car-sharing sheet may well remain a piece of paper, and that is a defensible answer.