DSG-Compliant CRM Systems: What Swiss SMEs Need to Know

The New Swiss Data Protection Act (DSG): What Has Changed?

Since September 1, 2023, the revised Swiss Data Protection Act (DSG) has been in force. For Swiss SMEs, this means:

Higher requirements for processing personal data
Notification obligation in case of data breaches
Documentation obligation for data processing
Fines up to CHF 250'000 for violations

Particularly affected: CRM systems that process personal data of customers, prospects, and contacts.

What Makes a CRM System DSG-Compliant?

1. Legal Basis for Data Processing

According to DSG, you must have a legal basis to process customer data:

Consent of the customer (explicit or implicit)
Contract fulfillment (e.g., quote, invoice)
Legitimate interest (e.g., CRM for existing customers)

A good CRM should be able to document the basis on which you process data.

TecArt Solution: Consent Management

TecArt offers:

Opt-in forms with DSG-compliant checkboxes
Consent tracking (When? Where? How?)
Double opt-in for newsletters
Withdrawal option for customers

2. Data Minimization and Purpose Limitation

You may only collect the data you actually need:

No "collecting for inventory"
Clear purpose limitation (e.g., "for quote preparation")
Automatic deletion after retention period expires

TecArt Solution: Customizable Data Fields

Define yourself which fields are mandatory
Set deletion periods for inactive contacts
Automated reminders for data deletion

3. Information Obligation (Privacy Policy)

Customers must be informed how their data is processed:

What data is collected?
For what purpose?
Who has access?
How long is data stored?

TecArt Solution: Built-in Privacy Policies

Templates for DSG-compliant privacy policies
Automatic linking on forms
Versioning of consents

4. Right of Access and Right to Data Portability

Customers can request information at any time:

What data do you have about me?
Where does this data come from?
To whom was data disclosed?

And they can request that you provide the data in machine-readable form.

TecArt Solution: Data Export at the Push of a Button

Automatic export of all customer data as PDF or CSV
Complete information reports in seconds
Audit logs for all data changes

5. Data Security and Technical Measures

You must take appropriate technical measures:

Encryption (transport and storage)
Access control (Who may see what data?)
Logging and monitoring
Regular backups

TecArt Solution: Enterprise Security

SSL/TLS encryption for all transmissions
Database encryption at-rest
Role-based access control (RBAC)
2-factor authentication (2FA)
Automatic backups (daily, encrypted)
Hosting in Germany (EU)

6. Notification Obligation in Case of Data Breaches

In case of data protection violations, you must inform the FDPIC within 72 hours.

TecArt Solution: Breach Detection

Automatic notification of unusual access
Audit logs for forensic analysis
Incident management system

Server Location: Why It Matters

The Problem with US Clouds

Many CRM systems (Salesforce, HubSpot, etc.) operate servers in the USA. This is problematic:

CLOUD Act allows US authorities access to data
Schrems II ruling makes US clouds GDPR-critical
DSG conflict with data transfer to unsafe third countries

TecArt: Hosting in Germany (EU)

TecArt offers:

Hosting in Germany (EU)
No data transfers to the USA

Cookieless Tracking: DSG-Compliant Analytics

The Cookie Problem

Many CRM systems use tracking cookies for website visitors:

Google Analytics
Facebook Pixel
Proprietary tracking cookies

According to DSG, you need explicit consent for such cookies (cookie banner).

TecArt: Cookieless Tracking with Matomo

TecArt integrates Matomo (formerly Piwik):

No cookie banner needed (when configured DSG-compliant)
IP anonymization by default
Hosting in Germany (EU)
Full control over your analytics data

Data Processing Agreement (DPA)

When you use a CRM, the provider is your data processor under DSG.

You need a DPA contract that specifies:

What data is processed?
What security measures apply?
What happens at contract end?

TecArt: Standard DPA Included

Free DPA contract for all customers
DSG and GDPR compliant
Digitally signable

Compliance Checklist: Is Your Current CRM DSG-Compliant?

Check:

| Criterion | ✅ Yes | ❌ No | |-----------|-------|---------| | Hosting location checked (CH or EU/EEA) and DPA in place? | | | | Encryption (transport & storage)? | | | | Consent management available? | | | | Data export at the push of a button? | | | | Audit logs for all access? | | | | DPA contract concluded? | | | | Deletion concept implemented? | | | | 2-factor authentication possible? | | | | Cookieless tracking or explicit consent? | | |

Less than 7 ✅? Your CRM is probably not DSG-compliant.

The Cost of Non-Compliance

Fines Under DSG

The DSG provides for fines up to CHF 250'000 – but only for intentional violations by natural persons (e.g., managing directors).

But the real costs are:

Reputational Damage

Media reports about data breaches
Customer trust is lost
Competitive disadvantages compared to compliant competitors

Customer Inquiries and Complaints

Access requests to process manually (1-2 hours per request)
Complaints to FDPIC (extensive correspondence)
Legal fees in case of lawsuits

Business Interruptions

If a data breach is reported:

IT forensic investigation (CHF 10'000 - 50,000)
Notification to FDPIC (72h deadline, high time pressure)
Customer notifications (if affected)

Best Practices for DSG-Compliant CRM Use

1. Internal Training

Data protection basics for all employees
CRM-specific rules (Who may see what?)
Phishing awareness (email security)

2. Regular Audits

Quarterly check: What data do we have?
Deletion of inactive contacts after period expires
Access rights update (new/former employees)

3. Encrypted Communication

TLS encryption for emails (STARTTLS)
No sending sensitive data via unencrypted email
Secure file sharing (not Dropbox/WeTransfer, but TecArt-integrated solution)

4. Documentation

Processing register maintain (what data, for what purpose?)
Document consents
Set and comply with deletion periods

Why TecArt is the Best Choice for DSG Compliance

Swiss SME Focus

TecArt is specifically developed for Swiss and German SMEs:

CHF invoices and Swiss VAT
German-language support (Zurich, Leipzig)
DSG and GDPR compliant out-of-the-box

No Hidden Compliance Costs

Many CRM providers charge extra for:

DPA contract
Data protection audits
Compliance modules

With TecArt, everything is included in the price.

Transparency and Control

No vendor lock-in – data export anytime
Open APIs for integrations
Hosting in Germany (EU)

Conclusion: DSG Compliance Is Not a Nice-to-Have

Since September 2023, the revised DSG has been in force. For Swiss SMEs, this means:

✅ Higher requirements for CRM systems ✅ Notification obligation in case of data breaches ✅ Fines for violations

A DSG-compliant CRM like TecArt offers:

✅ Hosting in Germany (EU) ✅ Consent management and opt-in forms ✅ Data export at the push of a button ✅ Audit logs for all access ✅ DPA contract included ✅ Cookieless tracking with Matomo

If you switch to a DSG-compliant CRM today, you protect:

Your company from fines
Your customers from data misuse
Your reputation from damage

Get advice now: Register as a TecArt partner

Avoiding Vendor Lock-in – Data sovereignty and flexibility
Salesforce Alternatives for Swiss SMEs – Local DSG-compliant solutions