--- title: "Your customer data and the Swiss data protection law: what an SME actually has to do" description: The revised Swiss data protection law (nDSG/nLPD) has applied since September 2023. A plain checklist of what it means for an SME's customer data and CRM. image: https://www.vidalico.com/hubfs/Blog_Featured_Swiss-Data-Protection.png --- [Skip to content](https://www.vidalico.com/blog/why-your-organization-should-prioritize-data-protection#main-content) Close - [What we do](https://www.vidalico.com/marketing-as-a-service) - [Digitalization Audit](https://www.vidalico.com/ai-and-digitalization-for-swiss-smes) - [CHAT WITH YOUR DATA™](https://www.vidalico.com/chat-with-your-data) - [Platforms](https://www.vidalico.com/hubspot) - [Growth as a Service](https://www.vidalico.com/marketing-as-a-service) - [Free AI-Readiness Check](https://www.vidalico.com/ai-readiness-check) - [About](https://www.vidalico.com/about-us) - [About us](https://www.vidalico.com/about-us) - [Success Stories](https://www.vidalico.com/success-stories) - [Blog](https://vidalico.com/blog) - [Contact us](https://www.vidalico.com/contact) SEARCH Contact us [![Vidalico\_Logo\_Horizontal\_color-1](https://www.vidalico.com/hubfs/Vidalico_Logo_Horizontal_color-1.svg)![Vidalico\_Logo\_Horizontal\_white](https://www.vidalico.com/hubfs/Vidalico_Logo_Horizontal_white.svg)](https://www.vidalico.com) - [What we do](https://www.vidalico.com/marketing-as-a-service) - [Digitalization Audit](https://www.vidalico.com/ai-and-digitalization-for-swiss-smes) - [CHAT WITH YOUR DATA™](https://www.vidalico.com/chat-with-your-data) - [Platforms](https://www.vidalico.com/hubspot) - [Growth as a Service](https://www.vidalico.com/marketing-as-a-service) - [Free AI-Readiness Check](https://www.vidalico.com/ai-readiness-check) - [About](https://www.vidalico.com/about-us) - [About us](https://www.vidalico.com/about-us) - [Success Stories](https://www.vidalico.com/success-stories) - [Blog](https://vidalico.com/blog) - [Contact us](https://www.vidalico.com/contact) Contact us Quick results for "{search\_term}" [Peter Tasala](https://www.vidalico.com/blog/author/peter-tasala)Jan 24, 2024, 4:14:39 PM4 min read # Your customer data and the Swiss data protection law: what an SME actually has to do [Previous](https://www.vidalico.com/blog/have-you-ever-played-corporate-ping-pong) [Next](https://www.vidalico.com/blog/harnessing-the-power-of-data-infrastructure-for-effective-ai) *A practical checklist for the revised FADP (nDSG / nLPD), without the legal jargon* Since 1 September 2023, Switzerland has a revised Federal Act on Data Protection, known as the nDSG in German and the nLPD in French. For many SMEs it arrived quietly: the privacy policy got an update, and life went on. That's understandable, but the law touches something every SME works with daily: customer and contact data in the CRM, in email, in spreadsheets and in the tools the team has added over the years. Here's what it means in practice, and what to check. *This article is a practical overview, not legal advice. For your specific case, check the guidance of the Federal Data Protection and Information Commissioner (FDPIC) or talk to a data protection lawyer.* ## What changed, in short - **Only people are protected now.** The law covers personal data of natural persons. Data about companies as such is no longer covered, but your contacts at those companies are. - **You have to tell people what you do with their data.** When you collect personal data, you must inform people about it, usually through a privacy policy that matches what you actually do. - **Privacy by design and by default.** Systems and processes should collect only what's needed and protect it from the start. - **Data breaches must be reported.** If a breach is likely to lead to a high risk for the people affected, you have to notify the FDPIC as soon as possible. - **People have clear rights.** Among others, the right to know what you store about them, to have it corrected, and in certain cases to receive it in a common electronic format. - **Personal fines.** Fines of up to CHF 250'000 can be imposed on the responsible individuals for intentional violations of certain duties, not only on the company. ## What this means for your CRM and customer data **Know where the data lives.** You can't answer a request for access, or report a breach properly, if you don't know which systems hold personal data. List your tools: CRM, email marketing, accounting, file storage, spreadsheets, and the AI tools people use. **Know where it's stored.** For each tool, check the provider and the country. Transfers abroad are allowed to countries the Federal Council recognises as having adequate protection, such as EU countries. For the US, providers certified under the Swiss-U.S. Data Privacy Framework are covered; otherwise you need safeguards like standard contractual clauses. **Have contracts with your providers.** If a provider processes personal data for you, a data processing agreement should be in place. Most large SaaS providers offer one; make sure it's accepted. **Keep only what you need.** Old contacts nobody has spoken to in years are a risk with no benefit. Agree how long you keep which data, and clean up regularly. **One person, one record.** If the same contact exists four times across systems, an access or deletion request becomes a small project. Clean, deduplicated customer data isn't just good for sales, it makes compliance manageable. **Watch the AI tools.** If your team pastes customer data into public AI tools, that data leaves your control. Set simple rules on which tools are allowed and what may go into them. ## Do you need a record of processing activities? The law requires a record of processing activities, but the ordinance exempts companies with fewer than 250 employees, unless they process sensitive personal data on a large scale or carry out high-risk profiling. Even if you're exempt, a simple list of systems, data and purposes is worth having: it's the basis for everything else on this page. ## A short checklist - We have a list of all tools that hold personal data, with provider and storage country. - Our privacy policy describes what we actually do, including the tools we use. - Data processing agreements with our providers are in place. - We know how to answer an access or deletion request, and who handles it. - We know what to do, and who decides, if there's a data breach. - We have rules for which AI tools may be used with customer data. - We clean out old contact data regularly. Want to see how data protection compares with your data, systems and processes? Take our free [AI-Readiness Check](https://www.vidalico.com/ai-readiness-check): twelve questions, about three minutes, and you see your score in five areas straight away. ## Where to start Data protection is one of the five areas we look at in our [Digitalization Audit](https://www.vidalico.com/ai-and-digitalization-for-swiss-smes), together with data, processes, systems and your team's use of AI. Not as a legal review, but as a practical check of where your customer data lives and what needs fixing before you build anything new on top of it. If you're moving to a new CRM, it's the best moment to get this right. Read [clean your data before you move it](https://www.vidalico.com/blog/clean-your-data-before-you-move-it). **[Start with the Digitalization Audit →](https://www.vidalico.com/ai-and-digitalization-for-swiss-smes)** ![avatar](https://www.vidalico.com/hs-fs/hubfs/Peter%20Tasala%20Data%20Analytics%20Advisory.png?width=290&name=Peter%20Tasala%20Data%20Analytics%20Advisory.png) [Peter Tasala](https://www.vidalico.com/blog/author/peter-tasala)Project Manager | Fintech & Financial Services Transformation | Data, Analytics & AI Strategy. With over 10 years of experience, I lead complex, client-facing technology and transformation initiatives within the banking, financial services, and fintech sectors. I specialize in bridging the gap between high-level business strategy and technical execution to deliver scalable, high-impact solutions. ## RELATED ARTICLES [![Vidalico\_Logo\_Horizontal\_white-1](https://2977752.fs1.hubspotusercontent-na1.net/hub/2977752/hubfs/Vidalico_Logo_Horizontal_white-1.png?width=300&name=Vidalico_Logo_Horizontal_white-1.png)](https://www.vidalico.com) - [What we do](https://www.vidalico.com/marketing-as-a-service) - [Digitalization Audit](https://www.vidalico.com/ai-and-digitalization-for-swiss-smes) - [CHAT WITH YOUR DATA™](https://www.vidalico.com/chat-with-your-data) - [Platforms](https://www.vidalico.com/hubspot) - [Growth as a Service](https://www.vidalico.com/marketing-as-a-service) - [Free AI-Readiness Check](https://www.vidalico.com/ai-readiness-check) - [About](https://www.vidalico.com/about-us) - [About us](https://www.vidalico.com/about-us) - [Success Stories](https://www.vidalico.com/success-stories) - [Blog](https://vidalico.com/blog) - [Contact us](https://www.vidalico.com/contact) SUBSCRIBE TO OUR NEWSLETTER Vidalico Digital 2022 © All rights reserved Helsinki, Finland - [Datenschutzerklärung](https://www.vidalico.com/de/datenschutz) - [Impressum](https://www.vidalico.com/de/impressum) ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "Switzerland", "addressLocality" : "Oberegg", "addressRegion" : "", "postalCode" : "9413", "streetAddress" : "Ruppenstrasse 3" }, "knowsLanguage" : "en", "logo" : { "@type" : "ImageObject", "url" : "https://2977752.fs1.hubspotusercontent-na1.net/hubfs/2977752/Vidalico_Logo_Horizontal_color.svg" }, "name" : "Vidalico Digital", "url" : "https://www.vidalico.com/blog/why-your-organization-should-prioritize-data-protection" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "abstract" : "The revised Swiss data protection law (nDSG/nLPD) has applied since September 2023. A plain checklist of what it means for an SME's customer data and CRM.", "author" : { "@type" : "Person", "name" : "Peter Tasala" }, "dateModified" : "", "datePublished" : "", "headline" : "Your customer data and the Swiss data protection law: what an SME actually has to do", "image" : "https://2977752.fs1.hubspotusercontent-eu1.net/hubfs/2977752/Blog_Featured_Swiss-Data-Protection.png", "inLanguage" : "en", "keywords" : "[]", "mainEntityOfPage" : { "@type" : "WebPage" }, "name" : "Your customer data and the Swiss data protection law: what an SME actually has to do", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2977752.fs1.hubspotusercontent-na1.net/hubfs/2977752/Vidalico_Logo_Horizontal_color.svg" }, "name" : "Vidalico Digital" }, "text" : "A practical checklist for the revised FADP (nDSG / nLPD), without the legal jargon Since 1 September 2023, Switzerland has a revised Federal Act on Data Protection, known as the nDSG in German and the nLPD in French. For many SMEs it arrived quietly: the privacy policy got an update, and life went on. That's understandable, but the law touches something every SME works with daily: customer and contact data in the CRM, in email, in spreadsheets and in the tools the team has added over the years. Here's what it means in practice, and what to check. This article is a practical overview, not legal advice. For your specific case, check the guidance of the Federal Data Protection and Information Commissioner (FDPIC) or talk to a data protection lawyer. What changed, in short Only people are protected now. The law covers personal data of natural persons. Data about companies as such is no longer covered, but your contacts at those companies are. You have to tell people what you do with their data. When you collect personal data, you must inform people about it, usually through a privacy policy that matches what you actually do. Privacy by design and by default. Systems and processes should collect only what's needed and protect it from the start. Data breaches must be reported. If a breach is likely to lead to a high risk for the people affected, you have to notify the FDPIC as soon as possible. People have clear rights. Among others, the right to know what you store about them, to have it corrected, and in certain cases to receive it in a common electronic format. Personal fines. Fines of up to CHF 250'000 can be imposed on the responsible individuals for intentional violations of certain duties, not only on the company. What this means for your CRM and customer data Know where the data lives. You can't answer a request for access, or report a breach properly, if you don't know which systems hold personal data. List your tools: CRM, email marketing, accounting, file storage, spreadsheets, and the AI tools people use. Know where it's stored. For each tool, check the provider and the country. Transfers abroad are allowed to countries the Federal Council recognises as having adequate protection, such as EU countries. For the US, providers certified under the Swiss-U.S. Data Privacy Framework are covered; otherwise you need safeguards like standard contractual clauses. Have contracts with your providers. If a provider processes personal data for you, a data processing agreement should be in place. Most large SaaS providers offer one; make sure it's accepted. Keep only what you need. Old contacts nobody has spoken to in years are a risk with no benefit. Agree how long you keep which data, and clean up regularly. One person, one record. If the same contact exists four times across systems, an access or deletion request becomes a small project. Clean, deduplicated customer data isn't just good for sales, it makes compliance manageable. Watch the AI tools. If your team pastes customer data into public AI tools, that data leaves your control. Set simple rules on which tools are allowed and what may go into them. Do you need a record of processing activities? The law requires a record of processing activities, but the ordinance exempts companies with fewer than 250 employees, unless they process sensitive personal data on a large scale or carry out high-risk profiling. Even if you're exempt, a simple list of systems, data and purposes is worth having: it's the basis for everything else on this page. A short checklist We have a list of all tools that hold personal data, with provider and storage country. Our privacy policy describes what we actually do, including the tools we use. Data processing agreements with our providers are in place. We know how to answer an access or deletion request, and who handles it. We know what to do, and who decides, if there's a data breach. We have rules for which AI tools may be used with customer data. We clean out old contact data regularly. Want to see how data protection compares with your data, systems and processes? Take our free AI-Readiness Check: twelve questions, about three minutes, and you see your score in five areas straight away. Where to start Data protection is one of the five areas we look at in our Digitalization Audit, together with data, processes, systems and your team's use of AI. Not as a legal review, but as a practical check of where your customer data lives and what needs fixing before you build anything new on top of it. If you're moving to a new CRM, it's the best moment to get this right. Read clean your data before you move it. Start with the Digitalization Audit →", "url" : "https://www.vidalico.com/blog/why-your-organization-should-prioritize-data-protection", "wordCount" : "1022" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Peter Tasala", "url" : "https://www.vidalico.com/blog/author/peter-tasala" }, "dateModified" : "2026-11-03T11:04:47.534Z", "datePublished" : "2024-01-24T14:14:39.000Z", "headline" : "Your customer data and the Swiss data protection law: what an SME actually has to do", "image" : [ "https://www.vidalico.com/hubfs/Blog_Featured_Swiss-Data-Protection.png" ], "mainEntityOfPage" : { "@id" : "https://www.vidalico.com/blog/why-your-organization-should-prioritize-data-protection", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.vidalico.com/hubfs/Vidalico_Logo_Horizontal_color.svg" }, "name" : "Vidalico Consulting" } } ```