Swiss labour law prohibits the use of control and monitoring devices for the purpose of monitoring the behaviour of employees at the workplace but allows the use of control and monitoring devices for other purposes, if necessary, provided the health and liberty of the employees is not compromised.

Prior to any monitoring, the employer should issue a detailed, written acceptable use policy setting out the purposes for which the employees may use internet access and the limitations that apply.

The employer is required to use adequate technical security measures, such as firewalls, to restrict infringements of the acceptable use policy, and keep such security measures technically up to date. Monitoring internet use is not a permissible alternative to reasonable technical security measures, but it may be used to complement them.

Systematic monitoring of an individual employee's internet use is prohibited. However, the monitoring of internet use through means that do not identify specific employees is allowed to ensure compliance with the acceptable use policy. Anonymous monitoring can be carried out without informing employees. Monitoring using pseudonyms, i.e. with the possibility to identify the authors of abusive usage, may not be employed universally and may only be used if the employees have been notified in advance of its potential use.

If anonymous monitoring provides evidence of infringement of the acceptable use policy, it is acceptable to begin monitoring which can identify the employee who is violating the acceptable use policy, provided that employees were notified in advance of the possible use of identity-based monitoring. Notices about identity-based monitoring should be given to employees in writing.

In addition, any monitoring needs to be performed in accordance with a monitoring policy which specifies who is in charge of the monitoring, what is monitored, who will be notified if an abuse is identified and what the consequences of such abuse are. It is recommended that this information be disclosed to employees, along with a statement of what action may be taken if the abusive use is believed to be a criminal act. The most straightforward way to provide this information is to give a copy of the monitoring policy to employees.

In practice, it often makes sense to establish a single policy which combines the acceptable use policy and the monitoring policy.