Data protection
Data protection that protects you instead of slowing you down
Your external data protection officer takes on the duties, the documentation and the contact with the authorities — practical, and without a department of your own.
Clarify your DPO need in 15 minutesHow we work together
No obligation, no sales pressure
GDPR / BDSG (German Federal Data Protection Act)
§ 38 BDSG20-employee threshold
The reality
A single reported breach can cost more than years of professional support. Data incidents are usually a question of when, not whether.
The risk of waiting
Fines of up to €20m or 4 % of global turnover. From 20 employees working with personal data, appointing a DPO is mandatory (§ 38 BDSG).
The advantage of acting
Demonstrable data protection is increasingly a selection criterion with B2B customers and in tenders — above all where sensitive customer or employee data is involved.
Which companies does data protection apply to?
Companies with 20 or more people processing personal data
Once at least 20 people are regularly involved in the automated processing of personal data, a data protection officer is mandatory (§ 38 BDSG, the German Federal Data Protection Act).
Companies handling particularly sensitive data
Anyone whose core activity involves processing health data on a large scale or systematically monitoring individuals needs a DPO regardless of headcount (Art. 37 GDPR).
What you get
- External DPOAppointment as data protection officer under Art. 37 GDPR, with a fixed contact who knows your company.
- Record of processing activitiesFully documented and kept current, so that you can produce it when the supervisory authority asks.
- TOM conceptYour technical and organisational measures, reviewed and described in a way that holds up as evidence.
- Processing agreements reviewedWe review your data processing agreements with service providers — cloud, payroll or hosting, for example.
- DPIAA data protection impact assessment for high-risk processing, methodically sound and documented.
- Data subject requestsAnswering access and erasure requests within the legal deadline, with templates and a clear procedure.
- Staff trainingShort, practical training so that your team handles personal data confidently day to day.
In almost every initial conversation we see the same picture: the record of processing activities was drawn up once and has barely been maintained since. New tools, service providers and processes are missing from it, and that is the first thing the supervisory authority asks about.
How we work together
Inventory & record of processing
Capture the data flows, set up the record of processing activities.
TOMs, processing agreements & risks
Review the technical and organisational measures and the contracts.
Ongoing support as your external DPO
A fixed contact, training, and contact with the authorities.
Have you already appointed a data protection officer?
We will establish what you need in a short conversation.
- No obligation
- No sales pressure
Frequently asked questions
When exactly do I need a data protection officer?
Under § 38 BDSG, appointing a data protection officer becomes mandatory as soon as at least 20 people are permanently engaged in the automated processing of personal data. Regardless of that number, the duty also applies under Art. 37 GDPR where the core activity consists of large-scale, regular and systematic monitoring of individuals, or where special categories of data — health data, for instance — are processed on a large scale. An external data protection officer fills the role independently of the company, which avoids the conflicts of interest that frequently arise when the role is held internally alongside another job (the head of IT acting as DPO, say). Fines for breaches follow Art. 83 GDPR and reach up to €20 million or 4 % of global annual turnover at the upper end.
We only have 15 employees — do we still need a DPO?
Not automatically under the 20-employee threshold, but yes if you process sensitive data on a larger scale. We give you a quick first assessment in the initial conversation.
Can an employee simply take on the role?
Legally possible, but often risky in practice because of conflicts of interest and a lack of depth. An external DPO is usually the safer answer.
Let's talk about your project.
Tell us what you have in mind. Your message goes straight to our team.
Daniel Tölgyesi
CEO
Loading the form …