DSG, GDPR and CRM: What Swiss Companies Need to Know

A CRM is the memory of your sales operation. It knows who received which quote, when the last conversation took place and who calls the shots at a given customer. That is exactly why it is also a sensitive system: a CRM accumulates personal data, often more than you realise. For Swiss SMEs this raises a double question. Which rules actually apply, and how do you put them into practice without grinding daily work to a halt? This article makes sense of the revised Data Protection Act and the GDPR and shows what really matters when you use a CRM.

DSG or GDPR: which law applies to you

Since 1 September 2023, Switzerland has had the fully revised Data Protection Act (revDSG). It draws heavily on the European GDPR, but is leaner and, for example, does not impose direct fines on the company as a whole, instead applying sanctions to the responsible individuals.

Many Swiss firms, however, are subject to both sets of rules at once. The GDPR also applies when a company without an EU presence deliberately offers goods or services to people in the EU or monitors their behaviour.

• You actively sell to customers in Germany, Austria or France.
• You run an online shop with prices in euros and shipping to the EU.
• You track the behaviour of EU visitors on your website.

If any of these apply, you should set up your CRM from the outset so that it meets the stricter requirements of the GDPR. As a rule, anyone who brings both logics together has also satisfied the DSG.

What actually counts in day-to-day CRM use

Data protection rarely fails because of grand concepts; it fails in the small habits of everyday work. Three principles help you keep the essentials in view.

Data minimisation instead of data hoarding

Only capture what you genuinely need for the business relationship. A buyer's date of birth, private notes about their behaviour or health-related information have no place in a sales CRM. Every field you do not keep is one you also do not have to protect, export or delete later.

Transparency and a legal basis

People have the right to know that you process their data and what for. A clear privacy notice is part of that, as is a sound basis for processing. In B2B sales this is often legitimate interest or the run-up to a contract, whereas for a newsletter it is usually explicit consent.

Take data subjects' rights seriously

If someone asks for access, correction or deletion, you have to respond promptly. A well-structured CRM is an advantage here: you find all of a person's records in one place, instead of piecing them together from mailboxes and Excel spreadsheets.

Data protection is not a one-off hurdle before you start, but a quality that a well-built system brings along quietly in the background.

Where the data sits, and why that matters

One key point is where the data is held. If personal data is transferred abroad, for instance because the CRM provider runs its servers in the USA, you need a valid basis for it. Holding data in Switzerland simplifies a great deal, because transfers to insecure third countries are ruled out from the start.

It gets trickier as soon as AI features come into play. When a system automatically creates a conversation summary from your notes or drafts an email, personal data is passed to a language model. Here you should know:

1. Which provider processes the data, and where?
2. Are the contents reused for training, or used only for the specific request?
3. Is there a data processing agreement that sets these points out in binding terms?

Anyone who clarifies these questions before rolling out the feature avoids letting a handy function turn into a silent compliance risk.

Compliance that doesn't get in the way

Data protection and efficient sales are not a contradiction. The art lies in building the rules into the system, rather than loading them onto employees as an extra obligation. That is exactly the thinking behind the idea "remove complexity, not add it".

At Advanzo, the CRM is built from the ground up for Swiss SMEs: the data stays in Switzerland, pricing is a fair flat rate, and AI features such as email generation, "deal scoring" or conversation summaries run on established models like Claude and OpenAI within a clearly defined framework. That keeps data protection where it belongs: in the background, reliable, without you having to think about the GDPR for every note.

The pragmatic path, then, is not to see data protection as a brake, but as a mark of quality. A CRM that handles personal data cleanly from day one builds trust with your customers, and in B2B that trust is often the real competitive advantage.