Every SME in sales collects contact data: business cards, enquiries, customer lists, email addresses. The revised Federal Act on Data Protection (DSG) has applied since 1 September 2023, and anyone holding contact data must be able to show where it comes from, what it is used for and what a promotional email is based on. This guide shows when consent for contact data is needed and when it is not, what to record, how to handle unsubscriptions, access requests and deletion requests, and what a clean contact base means in daily work.
Which contact data the law protects
The DSG applies to the processing of personal data of natural persons by private persons and federal bodies (Art. 2, para. 1). Personal data is any information relating to an identified or identifiable natural person (Art. 5 lit. a). “Processing” is any handling of it, from collecting and storing to deleting (Art. 5 lit. d).
For your contact list, this means: the contact person with name, job title, email address and telephone number is protected. The company as such is not, because the law applies to natural persons. As soon as an identifiable person belongs to a company, you are processing personal data, even for purely business contacts.
The principles in daily work
Art. 6 DSG sets out the principles. Personal data must be processed lawfully (para. 1), in good faith and proportionately (para. 2). It may be collected only for a specific purpose that is recognisable to the person concerned, and processed only in a way compatible with that purpose (para. 3). It must be destroyed or anonymised as soon as it is no longer needed for the purpose (para. 4). Anyone processing personal data must make sure it is accurate and take appropriate measures to have inaccurate or incomplete data corrected or deleted (para. 5).
In sales, this means: record only what you need for the customer relationship, note what an address was recorded for, clear out duplicates and outdated entries, and delete what no longer has a purpose. The law does not state in years how long you may keep an address; what matters is the purpose.
Consent or another ground?
An infringement of personality rights is unlawful unless it is justified by the consent of the person concerned, by an overriding private or public interest or by law (Art. 31, para. 1 DSG). Consent is therefore one of three possibilities, not the only one. An overriding interest of the controller may in particular be that it processes personal data about its contracting party in direct connection with concluding or performing a contract (Art. 31, para. 2 lit. a). For a customer’s invoice address, you therefore need no separate consent (on the invoice itself: Create a QR bill).
It is different with mass advertising by email (for example newsletters): Art. 3, para. 1 lit. o UWG requires prior consent, unless the exception for customers applies. The FDPIC describes the requirements: express, voluntary, after adequate information, withdrawable at any time; accepting general terms and conditions is not enough. The Federal Act on Data Protection adds (Art. 6, para. 6): where consent is required, it is valid only if it is given voluntarily for one or more specific processing operations after adequate information. The rules for the newsletter itself are covered in the guide “Newsletter law Switzerland” in this series.
Informing: what you must disclose
Anyone who collects personal data must inform the person concerned appropriately, even if the data is not collected from them (Art. 19, para. 1 DSG). At least the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients must be disclosed (para. 2). If the data does not come from the person themselves, the categories of data processed are added (para. 3) and the information is given at the latest one month after receiving the data (para. 5). The information must be precise, transparent, comprehensible and easily accessible (Art. 13 DSV).
The duty to inform lapses, among other cases, where the person already has the information (Art. 20, para. 1 lit. a) and, for data not collected from the person, where informing is impossible or requires disproportionate effort (Art. 20, para. 2). A privacy notice on the website, referred to by forms and email signatures, is customary (practice). Anyone who intentionally fails to provide the information risks, on complaint, a fine of up to CHF 250’000 (Art. 60, para. 1 lit. b).
Recording consent
Art. 6 DSG prescribes no particular form for consent. It must be express, among other cases, for the processing of particularly sensitive personal data (para. 7 lit. a). Practical recommendation (not statutory): record for every consent
- the address it applies to,
- the purpose (for example “newsletter” or “offers”),
- the date, source and text shown (form, conversation, card),
- any withdrawal with its date.
Keep purposes separate: someone who signs up for the newsletter has not thereby consented to telephone calls or offer emails. And keep consent and customer relationship separate: a purchase makes someone a customer, not automatically a newsletter subscriber.
Rights of contacts: access, rectification, deletion
Access. Anyone can request information on whether personal data about them is being processed (Art. 25, para. 1 DSG). They receive, among other things, the controller’s identity and contact details, the data processed, the purpose, the retention period and the available information on the source (para. 2). Access is in principle free of charge (para. 6); if it causes disproportionate effort, a contribution of at most CHF 300 can be requested, which must be communicated beforehand (Art. 19 DSV). It is generally provided within 30 days (para. 7); under Art. 18 DSV, within 30 days of receipt of the request, and if that is not possible, you inform the person and state the deadline. The request is made in writing or electronically (Art. 16 DSV); you must identify the person. The FDPIC states that the request does not need to be justified. Intentionally false or incomplete information risks a fine (Art. 60, para. 1 lit. a).
Rectification and deletion. The person concerned can demand that inaccurate personal data be rectified (Art. 32, para. 1). By bringing an action, they can demand, among other things, that data processing be prohibited, disclosure to third parties be barred or data be deleted (Art. 32, para. 2). Processing against the person’s express wishes is an infringement of personality rights (Art. 30, para. 2 lit. b).
Retention duties. Invoices generally serve as accounting vouchers (Art. 957a, para. 3 of the Code of Obligations (CO)); accounting vouchers must be retained for ten years, from the end of the financial year (Art. 958f, para. 1 CO). More on this in the guide Bookkeeping obligations for SMEs. How a deletion request relates to this duty in an individual case is a legal question. As practice, block contacts with an invoice link for advertising and follow-ups and leave the vouchers unchanged.
Practical example: Beispiel Holzbau AG
Beispiel Holzbau AG (fictitious) switches to a new contact management system and takes over its newsletter subscriber list of 1’200 rows, which it saves from Excel as a CSV file. Cleaning up the list reveals 85 rows repeating an address, leaving 1’115 addresses. On consent, the list shows the following:
| Group | Rows | Treatment |
|---|---|---|
| Sign-up date and source present | 640 | take over as consent |
| Sign-up date missing | 360 | “unresolved”, do not write to |
| Source missing | 115 | “unresolved”, do not write to |
| Total addresses | 1’115 |
The managing director decides: 640 addresses will receive the newsletter in future, the other 475 (360 plus 115) will not. She does not want to ask these 475 for agreement by bulk email, because even that can count as mass advertising without consent (interpretation; the court decides in each case whether it is mass advertising). She speaks to these people personally if they get in touch anyway. Three weeks later, a contact requests access; she supplies the company’s name and contact details, the stored information (name, email address), the purpose, the retention period or the criteria for it, and the source (“October 2026 import list”) within eight days, so before the 30 days expire. Another person withdraws consent; the address is blocked for advertising, and the invoices stay unchanged.
Checklist
- For every advertising address, the purpose, date and source of consent are recorded
- Purposes are kept separate (newsletter, offers, telephone)
- Privacy notice states identity, purpose and recipients
- For data not collected directly, the information was given within one month or the exception is documented
- Withdrawal and unsubscription take effect immediately and can be traced
- Duplicates are cleaned up, each address is held only once
- A process for access requests is in place: who replies, by when (30 days)
- Contacts with an invoice link are blocked rather than deleted if they refuse advertising
- Outdated contacts without a purpose are deleted regularly
How KMU | base helps
In Sales | base, every contact has a page with tabs. The Overview tab shows open deals, timeline, contact methods and relationships; Marketing holds tags and consents, and rarely needed items sit under More.
1. Record consent. In the Sales menu, open Contacts, the contact and the Marketing tab. Under “Legal bases and delivery blocks”, choose “Record basis” with address, purpose (for example newsletter or offers), type of basis and evidence. Consent counts only with evidence (when, where and how it was given). Other types, such as customer relationship, registration or research, are expressly not consent. The function “Consent per address and purpose, blocks, unsubscription, withdrawal” documents what a contact is based on at any time.
2. Withdrawal and blocking. You withdraw a consent on the entry (“Withdraw”). After a withdrawal, the address counts again only once you record a new, documented consent. With “Block address” you block an address by hand: it receives no more mailings, and pending mailings are stopped. Unsubscriptions, complaints and deletion requests remain blocked permanently. You block whole contacts with “Block contact” (“Exclude and block”); that can be reversed.
3. See the history. The timeline shows notes, activities, calls, emails and files, and below it the history of deals, emails, consents and log (“Timeline per contact”). For every value, you see where it comes from and what applied before (“Source priority and previous values”), which helps with questions about origin.
4. Prevent duplicates. You keep several email and telephone contact methods per contact, one of them primary; the same address cannot be created twice (“Several addresses with duplicate protection”). An unsubscription applies to the address, and because each address is held only once, it cannot slip past a second contact record.
5. Import with a dry run. You take over a newsletter list under Management › More › Import with the “Newsletter list” profile from a CSV or TSV file. The dry run shows totals and findings and changes nothing (“Import with mandatory dry run (CSV contacts, newsletter list, research list)”). Consent applies only with sign-up date and source; otherwise the address stays “unresolved” and receives no mailings. You take over whole contact databases from Excel or CSV with the import assistant under Company settings › Data exchange, with dry run, reconciliation report, approval and rollback (“Take over contacts from CSV or Excel”). If the consent column there says “yes”, Sales | base takes it over as consent for the newsletter with the note “Consent from the import file”. You therefore do not see the original evidence; keep it yourself and enter “yes” only where you have it.
Limits. Sales | base has no one-click access feature for contacts like the one in the HR area: you compile the information from the contact page, timeline and log, or export the list as CSV if you have the right to do so. You delete a contact only if there is no invoice link; otherwise “Exclude” remains. Sales | base has no automatic deletion periods for contacts; maintaining the database is your job.
The details of operation are in the Sales | base guide. If you would like to try it yourself, take a look at the Demo or open a test account. If you have questions, we will help you via the contact page. Prices: Pricing.
Sources
- Federal Act on Data Protection (DSG, SR 235.1), Art. 2, para. 1, Art. 5 lit. a and d, Art. 6, Art. 19, Art. 20, para. 1 lit. a and para. 2, Art. 25, Art. 30, para. 2 lit. b, Art. 31, para. 1 and para. 2 lit. a, Art. 32 and Art. 60, para. 1, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Data Protection Ordinance (DSV, SR 235.11), Art. 13, 16, 18 and 19, as at 1 December 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Federal Act against Unfair Competition (UWG, SR 241), Art. 3, para. 1 lit. o, as at 1 January 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Code of Obligations (CO, OR, SR 220), Art. 957a, para. 3 and Art. 958f, para. 1, as at 1 October 2026: fedlex.admin.ch (German original), accessed on 27.10.2026.
- FDPIC: Right to information (page without a date), accessed on 27.10.2026.
- FDPIC: Advertising & marketing, section on advertising by email (page without a date), accessed on 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27.10.2026.