Guide · 8 min read

Swiss FADP and CRM: what Swiss SMEs really need to know in 2026

Katia Ryze, an AI-generated character. Article prepared with AI and reviewed by the Ryze Systems team·6 June 2026

Ask yourself a simple question. Your customers’ contact details, their exchanges with you, their documents: on which server are they stored, this evening, as you read these lines? Most of the business owners we meet cannot answer. And that is precisely the problem the new data protection law has put on the table.

This article is not legal advice: for that, your lawyer or your data protection adviser remains the person to talk to. It is a practical reference, written for a busy business owner, on what really changes when you take a hard look at your CRM.

The FADP in one useful sentence

In force since September 2023, the revision of the Swiss Federal Act on Data Protection (FADP, nLPD in French) aligns Switzerland with the European standards of the GDPR. For an SME, the spirit fits in a few words: you are responsible for the personal data you collect, you must know where it is and who has access to it, and be able to document it. Vagueness is no longer an acceptable excuse.

What has changed is not so much the list of obligations as the level of expectation. You are asked for transparency about processing, a record of activities if you exceed certain thresholds, and particular vigilance as soon as data leaves Switzerland. This last point is the one almost everyone underestimates.

One point that few business owners realise deserves to be stated clearly: under the FADP, penalties can target an individual, not only the company. Fines (up to 250’000 francs in the most serious cases) fall first on the person responsible who failed in their obligations, which often means the owner personally. This is not said to frighten, but to put the priorities back in the right order: it is no longer only a risk for the company, it is a personal risk. And a personal risk is dealt with differently from one more line on a to-do list.

The real question is not “is my CRM compliant”

It is the question everyone asks, and it is badly put. Software is not “compliant” in the absolute; it is the use you make of it, and the place where it stores your data, that are compliant or not. The right question, the one that reveals the real risk, comes in two parts: where does my data physically live, and who can legally access it?

A CRM can display a fine “GDPR compliant” banner and host your data on a server subject to American law. The two statements do not contradict each other. They are simply not talking about the same thing.

Most popular CRMs are published by American companies. Even with a data centre in Europe, the parent company can remain subject to extraterritorial legislation such as the Cloud Act, which allows American authorities to demand access to data held by a US company, wherever it is stored. This is not a conspiracy theory. It is written in the text of the law.

Why your Swiss data should not fall under American law

Here is our position, and we stand by it. If you are a fiduciary firm in the canton of Vaud, a consulting firm in Geneva or an industrial SME in Fribourg, your customers’ data (often Swiss, sometimes sensitive) has no reason to be legally accessible from the other side of the Atlantic. It is not a matter of distrust towards this or that supplier. It is a matter of basic sovereignty over what has been entrusted to you.

The subject becomes burning in regulated professions. A fiduciary firm that hosts its clients’ accounting documents on an American infrastructure takes a risk that goes beyond the purely technical, and it is one of the points we cover in detail in digitalising a Swiss fiduciary firm.

During an audit, the Ryze team systematically asks a very simple question: "Where is your customer data hosted?" Eight business owners out of ten cannot answer. Not because they do not care, not because they lack rigour. Because nobody has ever asked them the question. They were sold a SaaS subscription with a nice interface and shown how to create contacts and generate reports. The question of hosting, of the applicable law, of the legal obligations was never raised. One owner who had been using HubSpot for three years discovered that day, during our audit, that his customer data was stored on American servers, subject to the American Cloud Act, which means that an American authority can access it without either he or his customers being informed. His reaction was simple: "Nobody ever told me that." Not anger, more a quiet and uncomfortable realisation. The Swiss FADP, in force since 2023, is precise on these questions. It requires companies to know where their data is processed and to be able to guarantee a level of protection equivalent to the Swiss standard, and it provides for penalties that directly target the individual responsible, not just the company, of up to CHF 250'000.

What you can check this week

1. Locate your data

Open the terms of your CRM and of each connected tool. Look for the mention of the hosting location and the nationality of the vendor. If the information cannot be found or is deliberately vague, treat that as a signal.

2. Map the access

Who, outside your team, can technically read your data? Subcontractors, third-party integrations and AI tools plugged into your mailbox all count. Every connection is a door.

3. Keep a human in the loop

Compliance is not only a matter of hosting. As soon as automated processing touches personal data (sorting, a follow-up, a qualification), a person must be able to check and correct it. Automation speeds things up; it does not remove responsibility.

The day a customer exercises their right of access

The FADP gives every person the right to ask what data you hold about them. It is a concrete scenario, not a textbook hypothesis. A customer writes to you: “What information do you have about me, and where is it?” You have a deadline to reply, and the answer must be complete.

Ask yourself the question now, with a cool head: could you answer? Across how many tools is their data scattered: the CRM, the mailbox, a spreadsheet, the invoicing tool, perhaps three integrations whose existence you have forgotten? If gathering this information would take you days and a few cold sweats, it is not an abstract legal problem. It is an organisational problem that the law simply reveals.

A company that does not know where its data lives cannot protect it, or prove that it protects it. The rest is only consequence.

The infrastructure angle: hosting where you have control

That is exactly the logic of the Infrastructure module of Ryze OS. Your data lives on controlled hosting in Switzerland or in the European Union, with access that you control and that is documented. You are not the tenant of a black box whose rules can change overnight. You remain the owner of what belongs to you.

We have deployed this approach on the 9 systems in production today, all hosted in the European Union, including that of a brokerage firm, an organisation subject to real confidentiality requirements. Data sovereignty there is not a marketing argument stuck on afterwards: it is the starting point of the architecture. And if your reflex is to compare with an existing management tool, we have set out the criteria in Bexio, Abacus or a custom CRM.

“Hosted in Switzerland” does not always mean what you think

Beware of a common marketing trap. A supplier can display “data hosted in Switzerland” while being a company under American law, or while subcontracting the infrastructure to a giant subject to extraterritorial laws. The physical location of the server is not enough; what counts is the legal nationality of the entity that controls access, and the chain of subcontractors behind it.

The right question to ask any vendor fits in one sentence: “Which entity, subject to which law, can technically access my data?” If the answer is clear, in writing, and points to a Swiss or European entity, you are on solid ground. If it is evasive, you already know what that hides. What a local provider changes on these questions is described in custom software in French-speaking Switzerland.

The right reflex

Do not change CRM in a panic. But stop not knowing. Take an hour, answer the three checks above, and you will know where you stand. If the answer makes you uncomfortable, there is work to do, and it is better to start it now, calmly, than after an access request you will not be able to honour.

A Ryze Systems audit systematically includes this mapping: where your data is, who has access to it, and how to take back control without breaking everything. Our delivered projects show what that looks like in practice.