GDPR and revFADP: What CRM Advisers Must Consider in 2026

At a glance

• The revFADP (Swiss revised Federal Act on Data Protection) has been in force since 01.09.2023
• The GDPR protection standard was largely adopted, but with Switzerland-specific rules
• CRM advisers are not directly responsible for the provider’s data protection compliance, but liable for incorrect advice
• The hosting location determines the data-protection requirements: hosting in Switzerland, in the EU (for example Germany), or in the United States
• A Data Processing Agreement (DPA/AVV) is a mandatory component of every CRM recommendation

What changed since 01.09.2023

The revised Swiss Federal Act on Data Protection (revFADP, often also called revDSG) replaced the old 1993 Data Protection Act on 1 September 2023. Key changes:

• Expanded information obligations when collecting personal data (Art. 19)
• Data protection impact assessment for high-risk processing (Art. 22)
• Breach notification to the FDPIC (EDÖB) (Art. 24)
• Privacy by Design / by Default (Art. 7)
• Increased fines up to CHF 250 000 for natural persons (Art. 60)
• Requirement for a processing record for companies ≥ 250 employees or when handling sensitive data

The revFADP aligns more closely with the EU GDPR but is not identical — it remains an independent Swiss law.

GDPR vs. revFADP — main differences

| Aspect | GDPR (EU) | revFADP (CH) | |--------|-----------|--------------| | Scope | EU citizens worldwide | Personal data processed in Switzerland | | Fines | Up to EUR 20 million or 4% of turnover | Up to CHF 250 000 (person) | | Data protection officer | Mandatory above certain thresholds | Recommended, not mandatory | | Right to data portability | Yes (Art. 20) | Yes (Art. 28) | | Right to be forgotten | Yes (Art. 17) | Indirectly via right to rectification | | Data Processing Agreement | Mandatory (Art. 28) | Mandatory (Art. 9) |

When advising Swiss clients whose data do not flow to the EU, you can primarily focus on the revFADP. With an EU connection (e.g. EU employees, EU customers), the GDPR additionally applies.

Data residency — the critical point

In 2026, data residency is the central compliance criterion for CRM recommendations. Three scenarios:

Scenario 1: Hosting in Switzerland

• Data remain in Switzerland
• No cross-border data transfer
• revFADP natively fulfilled
• No DPA for data transfer required (only AVV under Art. 9 revFADP)
• Recommendation possible without compliance reservations

Scenario 2: EU hosting (e.g. TecArt hosted in Germany, Pipedrive Frankfurt, HubSpot EU region)

• Data are processed in the EU
• GDPR directly applicable
• From a Swiss perspective: transfer to a foreign state (EU = recognised adequate level of protection)
• Standard Contractual Clauses (SCC) advisable, but not mandatory
• DPA with the provider is mandatory

Scenario 3: US hosting (e.g. Salesforce US, HubSpot default)

• Data are processed in the USA
• USA = no adequate level of protection from a Swiss perspective (FDPIC position)
• Transfer only permitted with additional safeguards:
  • Switzerland–US Data Privacy Framework (DPF)
  • Standard Contractual Clauses (SCC)
  • Binding Corporate Rules (BCR)
• DPA + Transfer Impact Assessment recommended
• Highest compliance risk for sensitive data

Data Processing Agreement (AVV/DPA)

Every CRM implementation requires a Data Processing Agreement between the client (controller) and the CRM provider (processor). Mandatory contents under revFADP Art. 9:

1. Subject matter and duration of the processing
2. Nature and purpose of the data processing
3. Categories of data subjects and types of data
4. Duties and rights of the controller
5. Data security measures of the processor
6. Sub-processors (hosting, backup, monitoring)
7. Access and rectification rights
8. Termination and data return / deletion

Swiss CRM providers such as TecArt supply AVV templates as standard. For US providers, GDPR/revFADP compliance must be verified individually.

Liability of the adviser

If you, as a fiduciary or IT consultant, recommend a CRM software, you are not directly responsible for its data protection compliance — that responsibility lies with the provider and the client.

However: Incorrect advice may be legally relevant. If you recommend a CRM to a client without pointing out known data protection risks, that may constitute a breach of the duty of care (CO 398).

Practical tip: A written recommendation should include the following points:

• Provider’s data residency
• Availability of an AVV/DPA template
• Known compliance risks (e.g. US hosting for sensitive data)
• Recommendation to conduct a data protection impact assessment for high-risk data types

Checklist: GDPR-compliant CRM recommendation

For every CRM recommendation, clarify the following points with the client:

• [ ] Data types identified (contact details, creditworthiness, health information?)
• [ ] Sensitive data types marked separately (revFADP Art. 5 lit. c)
• [ ] Data residency of the CRM provider clarified (CH/EU/US?)
• [ ] AVV/DPA available and signed?
• [ ] Sub-processors documented?
• [ ] Data protection impact assessment carried out for high risk?
• [ ] Processing record updated?
• [ ] Staff training for CRM use planned?
• [ ] Deletion concept for no-longer-needed data defined?
• [ ] Audit mechanism established (annual review)?

When a data protection impact assessment is necessary

A data protection impact assessment (DPIA) is mandatory under revFADP Art. 22 when the processing "may result in a high risk to the personality or fundamental rights of the data subject".

Typical triggers:

• Extensive processing of sensitive data types
• Profiling with legal or similarly significant effects
• Systematic monitoring of public areas
• New technologies with unclear risks

For a "standard" CRM implementation with contact and sales data, a DPIA is generally not mandatory but is recommended.

Conclusion: data residency first

For Swiss clients, the simplest compliance strategy is: review the hosting location and DPA before making a recommendation. Hosting in Switzerland avoids the complexities of cross-border data transfers. Hosting in Germany (EU), as used by TecArt, requires the transfer to the EU to be documented.

For recommendations involving US providers (Salesforce, HubSpot), the compliance burden is higher and should be documented explicitly in the advice.

Important note: Data protection law is complex and changes regularly. This article is general information, not legal advice. For critical constellations consult a specialised law firm or the FDPIC (EDÖB).

Sources

• revFADP — Federal Act on Data Protection
• Federal Data Protection and Information Commissioner (EDÖB)
• GDPR (EU) 2016/679
• Switzerland–US Data Privacy Framework (DPF) — as of 2026