Anyone who wants to implement a CRM usually has a simple problem: knowledge about customers sits in people’s heads, mailboxes and Excel lists. When someone leaves the company or is on holiday, nobody knows what was last discussed with the customer. A CRM (customer relationship management) brings this information into one place. It replaces neither conversation nor discipline in the team. This guide shows in six steps how to implement a CRM without it turning into a data graveyard, which data protection questions to settle beforehand and how to transfer your existing contacts cleanly.
What a CRM does – and what it does not
A CRM brings companies and contact persons, the history of conversations (calls, emails, notes), open sales opportunities and next steps together in one place. Everyone who deals with customers benefits: sales can see what administration has already promised, and the management can see how many opportunities are open.
A CRM does not create order by itself. If everybody records contacts differently, you get the same mess as in the Excel list, only more expensive. Plan more time for rules and data than for the software.
Step 1: Define the goal and scope
Describe in two or three sentences what should change. Good goals can be checked: “Every enquiry has a responsible person within one working day” or “No open deal without a next step”. Poor goals are wishes such as “more overview”.
Decide who will use it. For the start, sales and the management are usually enough. Administration, accounting and other departments can follow later. This recommendation is practice, not a rule: a small group with a clear benefit is more likely to succeed than a launch across the whole company.
Step 2: Review and clean existing data
Collect all sources: Excel lists, address books in email programs, an old CRM, business cards, trade fair lists. Check each source for four things:
- Duplicates: the same person several times, often with a slightly different spelling of the company.
- Outdated entries: people who no longer work at the company, companies that no longer exist.
- Gaps: entries without an email address, telephone number or town, which nobody can work with.
- Origin: where does the address come from? A customer relationship, an enquiry, a purchased list, a trade fair form?
The last point later decides what you may use the address for. Record it while you still know it. A record that consists only of a name and “from somewhere” is a risk, not an asset.
Step 3: Settle data protection
A CRM is a collection of personal data. The Federal Act on Data Protection (DSG) protects, however, only information about natural persons (Art. 1, Art. 5 lit. a DSG). The company as such is not covered; the contact person with name, email and job title certainly is. You should have settled the following points before the start:
- Principles: personal data must be processed lawfully and proportionately, in good faith and only for a specific, recognisable purpose (Art. 6, paras. 1–3 DSG). Record what you need for sales and customer care, not everything that can be recorded. Data that is no longer needed is destroyed or anonymised (para. 4); anyone processing data must satisfy themselves that it is accurate (para. 5).
- Information: anyone who obtains personal data informs the person concerned appropriately, even if the data was not obtained from that person. At a minimum, the identity and contact details of the controller, the purpose of processing and, where applicable, the recipients must be communicated (Art. 19, paras. 1–2 DSG). If the data does not come from the person, the categories of data processed are added and the information is given at the latest one month after receipt (paras. 3 and 5). The law provides exceptions (Art. 20 DSG), for example where the person already has the information. A privacy notice on your website is the usual place for these details.
- Provider: if a service provider runs the CRM for you, it is a processor. You must satisfy yourself that it can guarantee data security (Art. 9, para. 2 DSG). If the data is held abroad or can be accessed from there, the additional rules of Art. 16 DSG apply.
- Access: authorised persons should only be able to access the data they need for their tasks (Art. 3, para. 1 lit. a DSV). Not every employee needs to see everything.
- Register: the DSG requires a register of processing activities (Art. 12). Enterprises employing fewer than 250 people on 1 January of a year are exempt, unless they process sensitive personal data on a large scale or carry out high-risk profiling (Art. 24 DSV). For most SMEs the obligation does not apply. A short internal register is still a good exercise.
Advertising is a separate topic. A contact in the CRM is not yet consent to advertising emails. For mass advertising sent by telecommunications (for example by email), the Federal Act against Unfair Competition (UWG) in principle requires prior consent, correct identification of the sender and a reference to a simple and free way of refusing (Art. 3, para. 1 lit. o UWG). An exception applies to customers whose contact details you obtained in the course of a sale, for your own similar services and with a reference to the option of refusing. The FDPIC states that a sale or a service provided is required for this; a mere online account is not enough. In the CRM, therefore, separate right from the start who is a customer, who made an enquiry and who has expressly consented.
Step 4: Define the structure
Before you load data, decide on a few rules that everybody follows:
- Mandatory details: what must a contact have at a minimum? For example company, town, email or telephone.
- Origin: a short list of values such as referral, website, trade fair, existing customer.
- Sales stages: how does an opportunity run from enquiry to close, and how do you recognise that it has reached the next stage? More on this in the guide to the sales pipeline.
- Responsibilities: who looks after which customer? Who may delete or merge contacts?
- Naming rules: how company names are written (with or without “AG”), form of address, language.
Write these rules on one page. This sheet is your most important implementation document.
Step 5: Transfer data with a dry run
Never import directly into the live data. A dry run shows how many records would be created, how many already exist and what is rejected, without anything being written. Check the rejections, correct the source file and repeat the dry run until the result is right. Only then do you release the import.
Two rules of thumb help: clean the source first, then the import. And import consents only with evidence (date and source). If the evidence is missing, treat the address as a contact without a basis for advertising.
Step 6: Bring the team along
A CRM works only if people use it every day. Three habits carry the implementation:
- The morning look: everyone opens the daily overview first: what is due today, what has been lying around for days?
- One source of truth: what is not in the CRM counts as not discussed. This applies to the management first.
- Next step: every open case has a date for the next step.
Allow for a pilot of a few weeks in which you make improvements. Ask the team where it gets stuck before you add more departments.
Practical example: Muster Metallbau AG
Muster Metallbau AG (fictitious, 14 employees) keeps its customers in an Excel list and in three personal address books. Goal: every enquiry has a responsible person, and everyone sees the status. The list has 1’240 rows. The clean-up gives:
| Step | Rows |
|---|---|
| Starting list | 1’240 |
| less duplicates (same email) | 118 |
| less rows without email and without telephone | 62 |
| To be imported | 1’060 |
The first dry run reports 1’046 new contacts, 0 changed and 14 rejected rows (faulty email format). The company corrects the 14 rows and repeats the dry run: 1’060 new, no rejections. Then it releases the import.
Of the 1’060 contacts, 230 are also on the old newsletter list, with sign-up date and source. The company transfers these consents in a separate run, with evidence. For the other 830 contacts (1’060 minus 230) there is no documented consent. Muster Metallbau sends them no advertising emails until consent exists or the exception for customers clearly applies (a sale with a reference to the option of refusing, Art. 3, para. 1 lit. o UWG). Replies to enquiries and ongoing business correspondence remain possible. In the pilot, the management and two salespeople work with the CRM for four weeks. Afterwards, administration adds its customers.
Checklist
- Goal formulated in two to three checkable sentences
- Group of users for the start defined
- All data sources collected, duplicates and outdated entries cleaned
- Origin of each address known or marked as “unknown”
- Privacy notice covers processing in the CRM (Art. 19 DSG)
- Access rights assigned by task (Art. 3, para. 1 lit. a DSV)
- For an external provider: processing and data security clarified (Art. 9 DSG)
- Mandatory details, origin values, sales stages and naming rules defined
- Import file cleaned and dry run repeated until no rejections remain
- Consents transferred only with evidence
- Pilot with a small team planned
How KMU | base helps
Sales | base brings contacts, sales opportunities and history together. This is what getting started looks like.
1. Find and link contacts. In the Sales menu, open Contacts. You search and filter companies and persons and see on a detail page who belongs to which company (“Search, filter and link contacts”). The contact page has the tabs Overview, Marketing (tags and consents) and More.
2. Transfer data. For lists in CSV format there is the item Import under Management (in the sidebar under “More”). It works with a mandatory dry run: the dry run shows totals and findings and changes nothing. The profile “CSV contacts” supplements existing contacts only in empty fields and creates no basis for advertising. The profiles “Newsletter list” and “Research list” require evidence; for a newsletter list, the basis remains “unresolved” without evidence, and nothing is sent. If you prefer to work with an Excel file, use the item Data exchange under Company settings: in the Import tab, choose the target “Contacts”. Mapping and dry run come first; nothing is written until you release it (“Transfer contacts via CSV or Excel”). The file may have at most 20 MB and 50’000 rows; Excel without macros, formulas are not calculated. An executed import can be rolled back as long as nothing has been built on it (“Roll back an executed import”).
3. Switching from an existing CRM. The KMU | base team carries out the transfer from an existing CRM, including reconciliation and re-import without duplicates (command line); you do not do this yourself. Ask about it via the contact page.
4. Working day to day. The Overview starts with “To do today”: due tasks, deals that have stalled, new leads and mentions, each with a reason and one click to act. From there you create a task, deal, lead and contact with one click (“Daily desk”).
Two notes on the limits: duplicates that arise despite the clean-up are merged with a field preview and can be undone (“Merge with field preview”); it is cleaner to clean up before the import. And the origin of a contact is stored but is not yet visible on the contact page (only the origin of a tag appears as a note); record it additionally in tags. The details of operation are in the Sales | base guide. For further reading: Write a quote shows what a quote should contain.
If you would like to try it yourself, take a look at the Demo or open a test account. You will find the current terms under Pricing; if you have questions, we will help you via the contact page.
Sources
- Federal Act on Data Protection (DSG, SR 235.1), Art. 1, 5 lit. a, Art. 6, paras. 1–5, Art. 9, para. 2, Art. 12, Art. 16, Art. 19, paras. 1–3 and 5, Art. 20, as at 7 July 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Data Protection Ordinance (DSV, SR 235.11), Art. 3, para. 1 lit. a and Art. 24, as at 1 December 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- Federal Act against Unfair Competition (UWG, SR 241), Art. 3, para. 1 lit. o, as at 1 January 2025: fedlex.admin.ch (German original), accessed on 27.10.2026.
- FDPIC: Advertising & marketing (page without a date), accessed on 27.10.2026.
This guide does not replace legal or tax advice. Information as at 27.10.2026.