Data Protection. Leave it with us.

Data Protection Consultancy

We provide consultancy services for all aspects of data protection related to your business. Our focus is on delivering practical, straightforward solutions that enable your business model to thrive – all while ensuring GDPR compliance wherever possible.

Data Protection Officer

In Germany, companies with 20 or more employees are legally required to appoint a data protection officer (DPO). However, even if your company falls below this threshold, appointing one can still be beneficial. As your external DPOs, we bring the requisite expertise and up-to-date GDPR knowledge to the table. Compared to an internal appointment, outsourcing this role to us saves you both time and resources. You also won’t need to worry about labour laws that make it nearly impossible to dismiss an internal DPO – or about training someone from scratch.

Data Security

By law, you are required to protect personal data from unauthorised access, accidental loss, or destruction. In essence, this is what most people think of as data protection.

We will assess your existing data security measures – also lovingly called TOMs – and optimise them to strengthen data protection within your company.

Chances are, you also have other valuable company assets or sensitive information worth protecting beyond personal data. Well, you’re in luck: Securing your data also means safeguarding your trade secrets.

Data Processors

Companies remain accountable for any data processing they outsource to third-party service providers. GDPR mandates that you have the right contracts in place. We can review your existing agreements or support you in concluding them in the first place. If you ask nicely, we can even communicate directly with your providers and provide tailored templates.

If the boot is on the other foot, we’ll support you in your negotiations with clients and review the contracts they expect you to sign as their data processor.

Projects

Developing bespoke solutions for extraordinary projects is what we love most. We firmly believe data protection shouldn’t hold you back but should instead serve as an opportunity to refine and elevate your ideas. Time and again, we’ve seen how well-implemented and thoughtfully designed data protection measures lead to better outcomes for everyone involved. Not to mention that knowing you’ve done your data protection homework can be a real confidence booster.

We’ve tackled data protection challenges ranging from the everyday to the truly complex: mailouts, photo usage, online shops, CRMs, whistleblower portals, all the way to Europe’s largest IoT project, delicate access bans, or extensive video surveillance. We can’t wait to hear about what exciting challenges you have in store for us.

Responding to Data Protection Authorities

If, despite everything we’ve done together, you end up receiving a letter from the Data Protection Authority, we’ll work closely with our partner law firm, WLHK, to coordinate an appropriate response strategy. Be it on-site audits or written questionnaires, we’ve got your back.

Internal Guidelines

For your staff to comply with data protection laws, they need clear guidance and instructions. Otherwise, mistakes or infringements could fall back on you. We’ll help you develop pragmatic internal guidelines tailored to your needs.

Of course, we know that guidelines often go unread – let alone followed. That’s why we focus on feasibility and straightforward messaging to ensure they’re both practical and effective.

Staff Training

Weirdly enough, GDPR training sessions seem to have a reputation for being dry and boring – but they don’t have to be! We’ll come in and deliver interactive, engaging training sessions tailored to both management and staff. The content will be customised to your needs, featuring relevant use cases and practical examples.

Data Protection Audits

An internal data protection audit provides valuable insights into your data processing practices and helps identify potential compliance gaps. We’d be delighted to put our auditing skills to work for you.

Should you ever find yourself being audited by a client, we’ll guide you through the process. We are also able to audit your service providers to ensure they meet compliance standards.

Transfer Impact Assessments

Transferring personal data to countries outside the EU may require a Transfer Impact Assessment (TIA) to evaluate risks and implement appropriate safeguards, depending on the level of data protection in the third country. We’ll map your data flows and assess these cases for you.

Data Protection Impact Assessment

When planning projects involving data processing that may pose a high risk to data subjects, a prior Data Protection Impact Assessment (DPIA) is mandatory. Identified risks must be mitigated with appropriate security measures.

We’ll support and document your Data Protection Impact Assessments to ensure compliance and clarity.

AI Regulation

The EU’s new AI Regulation establishes a framework for the use of artificial intelligence. Data protection is just one of many requirements when implementing AI projects or using AI tools.

In collaboration with our partner law firm WLHK, we can assess and support your project, provide employee training, and help you comply with the requirements of the AI Regulation.

NIS-2 Directive

If your organisation is subject to the new EU NIS-2 Directive on cybersecurity, we’ll support you with your registration and reporting obligations. Most importantly, we’ll collaborate with your IT department or service provider to review your existing security measures and develop a practical and effective security plan tailored to your needs.

Additional Legal Support

Occasionally, complex matters or legal issues may extend beyond our scope as Data Protection Officers. In such cases, our partner law firm WLHK is ideally positioned to advise you on advanced data protection matters, as well as competition and media law.