HESTA & Compliance Overview
HESTA is the mandatory monthly statistic of Swiss accommodation providers, collected by the Federal Statistical Office. CampOne produces the report automatically from your booking data — you review, sign, and submit with one click. No spreadsheets, no manual entry.
The module also covers guest registration (digital or at reception), mandatory reporting for foreign guests, and a full audit trail of every change. The latter satisfies the requirements of the new Swiss Federal Act on Data Protection (nDSG) as well as — for cross-border offerings — the GDPR.
All data is hosted exclusively in Swiss data centres (Swiss Hosted).
What you’ll find here
Section titled “What you’ll find here”| Page | Content |
|---|---|
| Guest registration | Mandatory fields, portal capture, ID scanner, companions |
| Audit trail | What is logged, permissions, tamper resistance, authority export |
| nDSG | DPA, subject rights, retention, TOM, data breach |
Who’s affected
Section titled “Who’s affected”- Owner / management is legally responsible for HESTA submission and nDSG compliance
- Reception captures guests, verifies advance data, scans IDs
- Bookkeeping / controlling pulls statistics from the HESTA module
- Police / authorities receive data only on a specific request, with audit stamp
Legal frame
Section titled “Legal frame”Three legal regimes intersect in this module:
| Norm | What it requires |
|---|---|
| Federal Statistics Act | Monthly HESTA submission of overnights by country of origin |
| Cantonal police / accommodation laws | Guest registration and retention |
| Foreign Nationals Act Art. 16 | Extended reporting duty for foreign guests |
| nDSG (revised FADP) | Data protection, subject rights, processing register |
| GDPR | Relevant for EU guests; CampOne setup is GDPR-compliant |
| VAT Act | 10-year retention of accounting records |
CampOne covers all technical requirements; the organisational implementation (e.g. who has access to what) is on you.
HESTA workflow
Section titled “HESTA workflow”- Daily capture — overnights are derived automatically from bookings
- Monthly close — on the 5th of the following month CampOne prepares the report
- Review — you check the values (countries, overnights, arrivals)
- Signature and submission — electronic signature, direct transfer to FSO
- Archival — the report is filed as a PDF in the audit trail
A correction is possible in the next month; later corrections must be discussed with FSO directly.
Prerequisites
Section titled “Prerequisites”- Registration as a data submitter with the Federal Statistical Office (CampOne can act under power of attorney)
- BUR number of your business
- Tourist-tax rates configured (data shared with HESTA)
- Reception training on the mandatory fields
These steps are part of onboarding.
Data protection at a glance
Section titled “Data protection at a glance”| Measure | Status |
|---|---|
| Hosting in Swiss data centres (Swiss Hosted) | Standard |
| Encryption at rest and in transit | Standard |
| Tenant isolation (no commingling with other sites) | Standard |
| Daily geo-redundant backup | Standard |
| Data processing agreement (DPA) | Standard, part of main contract |
| External pen-test | Annual |
| Incident notification within 24 hours | Contractually committed |
More details on the nDSG page.