The Revised Data Protection Act (revDSG) and Your CRM

Since 1 September 2023, the revised Data Protection Act, or revDSG for short, has been in force in Switzerland. For many SMEs, this was at first mainly one more line on the to-do list - somewhere between the tax return and the VAT statement. But anyone who works regularly with customer data, and that means practically every company with a CRM, can't avoid the topic. The good news: if your system is set up cleanly, the revDSG isn't a bureaucratic monster, but simply good practice. This article shows you what concretely matters and how your CRM goes from a risk to an ally in the process.

What changed with the revDSG

The old Data Protection Act dated from the early nineties - a time without the cloud, without automated marketing and without AI. The revision brings Switzerland closer to the European GDPR, but remains independent. For your day-to-day business, these points are especially relevant:

• Duty of transparency: You have to inform the people concerned that you process their data and for what purpose. This also applies to contacts you didn't collect yourself, such as purchased leads.
• Record of processing activities: Companies must document which data they process and for what purpose. Very small businesses are partly exempt, but a record never hurts.
• Right to information and erasure: Customers can request to learn what data you hold about them - and demand its deletion.
• Privacy by design and by default: Data protection should be considered from the start, not bolted on afterwards.
• Higher fines: Violations can now cost up to CHF 250,000 - and that falls on the responsible person, not primarily the company.

Why the CRM is at the centre

Your CRM is where most personal data comes together: names, email addresses, phone numbers, conversation notes, purchase histories. This is exactly where it's decided whether you comply with the revDSG or not. A request for information can only be answered within a reasonable time frame if you can see in just a few clicks which data exists about a person. A scattered jumble of Excel spreadsheets, email inboxes and sticky notes makes that almost impossible.

Data protection isn't a one-off task, but a property of a well-run system - and the CRM is its heart.

It gets particularly sensitive when AI functions come into play. When a tool automatically drafts emails or summarises conversations, personal data is transmitted to language models. Here you should know exactly where that data flows and whether it's reused for training.

A pragmatic checklist for SMEs

You don't have to solve everything at once. This order has proven its worth:

1. Get an overview: where is customer data stored everywhere? The goal is to consolidate as much as possible in the CRM.
2. Define who on the team is allowed to access which data. Not every person needs access to everything.
3. Set deletion deadlines. Data you no longer need is a risk, not an asset.
4. Record which service providers you share data with - including the location of the servers.
5. Prepare a template you can use to answer information and deletion requests quickly.

The server location makes a difference

If your data is kept in Switzerland, that simplifies compliance considerably, because no additional safeguards are needed for a transfer abroad. With providers whose servers are in the USA, it quickly gets more complicated. So it's worth taking a look at the fine print of your CRM provider.

Data protection as a trust advantage

It's easy to see the revDSG as a tiresome obligation. But handling data cleanly is also a selling point. Swiss customers care that their information is treated seriously. Anyone who communicates this credibly gains trust - and in B2B business, trust is often the decisive factor.

This is exactly where Advanzo comes in. As an AI-powered CRM for Swiss SMEs, the data is kept in Switzerland, and AI functions such as email generation, "deal scoring" and conversation summaries are built so that you stay in control. True to the philosophy "remove complexity, not add it", the point isn't to push yet another compliance tool on you, but to make data protection a quiet matter of course. The revDSG thus turns from a hurdle into the foundation for a company people are happy to entrust their data to.