Data protection knowledge & news

There are many NIS2 software solutions that can support companies in implementing the requirements. Generally, they all claim to be "NIS2 ready." For SMEs, it is more important to consider who the solution was built for, how complex the implementation is, and what happens when additional requirements are added to NIS2. This comparison provides guidance for choosing the right provider.

Does your company use Microsoft 365, Google Workspace, Salesforce, or AWS? If so, you are transferring personal data to the United States. Transatlantic data transfers were previously legally secure, but a US Supreme Court ruling in June 2026 has shaken this foundation. Almost every organization in Europe is affected.

How much does ISO 27001 certification truly cost? The answer depends on company size, maturity level, and scope – and therefore varies widely. Only looking at the audit underestimates the total costs. This article outlines all relevant cost components, typical price ranges by company size, and the most important levers to strategically manage effort and budget.

Ihr ISO 27001-Audit steht bevor, die NIS2-Umsetzung ist beschlossen, Ihr VVT ist auf dem aktuellen Stand – und jetzt das: Mit dem „Digitalen Omnibus“ hat die EU-Kommission ein Gesetzespaket vorgelegt, das zentrale Säulen des Datenschutz- und Compliance-Managements von KMU verändern könnte und auch KI-Regeln betrifft.

The demands placed on data protection providers vary significantly from one company to another. While some primarily seek legal support, others also require assistance with documentation, internal processes, external data protection, or related compliance topics. For this reason, it's beneficial to examine the specialization of each provider closely. Not all providers offer the same range of services, and not every model is suitable for every company size. The following comparison of the best data protection providers highlights their key areas of focus and the types of companies they are best suited for.

German companies are looking to become more digitally independent from non-European cloud providers. To help them evaluate and compare the sovereignty of cloud services, the EU has established uniform standards through the SEAL framework. How practical is this rating scale for businesses, and what steps should be taken now?

An Information Security Management System (ISMS) allows you to systematically protect your organization's internal and external information from unauthorized access. This overview summarizes the key facts about ISMS and best practices for its implementation.

A robust Information Security Management System (ISMS) forms the backbone of an effective corporate security strategy. Learn how to implement such a system in your company to keep hackers at bay.

Managing all requirements and documentation across GDPR, NIS2, and AI compliance is a particular challenge, especially for SMEs. Many companies still manage their compliance data and tasks manually in spreadsheets. In day-to-day operations, it's easy to quickly lose track of time and a clear overview. A GRC platform eases the burden, but is it the right solution for SMEs?

The NIS2 Implementation Act has been in force since December 6, 2025. From now on, compliance officers must report significant security incidents within 24 hours. This guide shows you what other deadlines apply and how to safely meet them in an emergency.

A GDPR data protection audit offers small and medium-sized enterprises (SMEs) the opportunity to voluntarily have their data protection compliance reviewed and to demonstrate it externally through a certificate. Find out what to expect during preparation and the audit process.

As the use of artificial intelligence (AI) in businesses increases, so does the need for clear legal rules. Since August 2024, the European Union's AI Act has provided a legal framework for the regulated and secure use of AI systems in the EU. The AI Regulation (AI-VO) came into force on August 1, 2024 – with staggered transitional periods until 2027. In this article, you will learn about the specific requirements your company will face and how to minimize compliance risks.

The GDPR is based on a simple principle: the higher the risk to the individuals involved, the more extensive the protective measures must be. Risk analysis is therefore the foundation for almost all data protection decisions within a company—from selecting technical measures and reporting data breaches to determining whether a data protection impact assessment is required. This article explains how it works in practice.

As an autonomous AI agent, OpenClaw promises efficiency and relief in everyday work. In practice, however, this primarily creates new risks for information security and data protection. Because in order to carry out tasks independently, the agent needs extensive access rights. We will clarify whether it is currently advisable to use OpenClaw in the company.

The GDPR requires companies to systematically and rule-based delete data that is no longer needed. A data deletion policy defines what data is deleted when, who is responsible for it, and how exceptions are handled. Learn what a complete data deletion policy must contain and how to implement it efficiently.

When employees submit their resignation, employers must not only manage succession planning but also ensure the data protection-compliant handling of personal employee data. Otherwise, there's a risk of violating the GDPR. Read all about the obligations, deadlines, and how to properly carry out data deletion.

If external service providers process personal data on behalf of your company, the GDPR requires you to enter into a contract with them that sets out the terms and conditions for this processing. Learn what a data processing agreement (DPA) entails and why it is essential for your business.

Data security and data protection are not synonyms, but two important tasks for companies. Learn how to clearly distinguish between both areas and implement them efficiently.

Data security is of paramount importance in the digital age. This is especially true for companies that manage and process large volumes of data—such as that of customers, suppliers, business partners, and employees. Data security officer, IT security officer, data protection officer—at first glance, these terms seem almost identical and interchangeable. However, a closer look reveals distinct differences.

If you are searching for "terms and conditions privacy policy," you are usually looking for two things: legal clarity and a practical solution. In practice, the rule is almost always the same: terms and conditions, privacy policies, and terms of use are distinct legal instruments—each with different requirements regarding content, presentation, and implementation.

The General Data Protection Regulation (GDPR) requires companies to implement technical and organizational measures (TOMs) to ensure the secure processing of personal data. TOMs are the foundation of any GDPR-compliant data processing. In this guide, you will learn which measures are mandatory, how the 14 control areas work, and how to document your TOMs in a legally compliant manner—including practical tips for remote work and data processing agreements.

In large companies and corporations in particular, data protection can quickly become complex. The GDPR allows organizations to appoint a group data protection officer to ensure consistent data protection standards across the entire group.

A Data Protection Officer ensures that companies securely meet GDPR requirements and protects against data breaches. But what if incidents still occur, or the supervisory authority suddenly imposes fines? This article shows which mistakes you should avoid when working with Data Protection Officers.

Are you looking to appoint a data protection officer for your company and wondering if your candidate truly possesses the specialized knowledge, IT expertise, and experience your business requires? Discover which qualifications are essential for a DPO’s responsibilities, when a legal expert is a better fit than an IT specialist, and what it takes to ensure your data protection is not only compliant but also efficient.

What is a GDPR data protection officer, and how do internal data protection experts differ from other roles? This article provides clarity.

Companies that use Artificial Intelligence (AI) need effective AI governance. AI usage policies play a central role: they clearly show employees the benefits and limitations of the technology and how to work safely with AI. Our guide provides tips on how to create your own AI Policy.

Data protection officers aren't just found in private companies. At the state and federal level, there are also federal and state data protection commissioners. Find out why your data protection officer should be familiar with these authorities.

WeTransfer is a popular online service for sending large file attachments – but what about data protection? Discussions surrounding access rights in the terms and conditions and data storage on US servers raise important questions for compliance officers. This article provides a GDPR compliance check and demonstrates how SwissTransfer performs as a data protection-compliant alternative.

Storing personal data – but for how long? This question arises daily in companies: On the one hand, the GDPR requires data to be deleted as soon as the processing purpose ceases. On the other hand, there are statutory retention obligations and periods from the German Commercial Code (HGB), Tax Code (AO), or Income Tax Act (EStG) that mandate longer storage. This guide shows you how to meet both requirements, avoid fines, and maintain an overview.

The use of AI tools is a massive trend in the workplace – but with innovation comes responsibility: data protection and GDPR compliance must be a top priority for companies using artificial intelligence. Those who deploy AI solutions like ChatGPT, Copilot, or Google Gemini need to understand how these systems handle personal and sensitive data. The central question is: Which of these AI tools meets European data protection requirements – and where do risks lurk? In the following overview, you will learn how ChatGPT, Microsoft Copilot, and Google Gemini fare regarding GDPR. We will also examine key topics such as data minimization, transparency, controllability, risk assessment, and accountability – and present DeepSeek as a negative example of GDPR violations.

Google continues to dominate the global search engine market with a share of around 92% – but awareness of data protection and compliance requirements has fundamentally changed. For compliance officers in medium-sized companies, the question increasingly arises: How can we ensure secure, GDPR-compliant search processes? This article introduces 7 data protection-compliant search engine alternatives.

After years of criticism from data protection authorities, Google is taking action: starting April 2, 2026, Google will process reCAPTCHA data under a data processing agreement (DPA). This article explains what this means for your company and the steps you need to take now.

Internal data protection officers benefit from special protection against dismissal, which presents many employers with legal challenges. This article explains when termination is possible, how it differs from removal from office, and what alternatives are available.

NIS2 requires supply chain security, GDPR demands transparent data processing, and DORA targets ICT security in the financial sector. Those who don't fully control their IT systems and data will struggle to meet these regulations. Digital sovereignty is therefore no longer a nice-to-have, but a prerequisite for demonstrable compliance.

Hybrid attacks, political tensions, and sabotage demonstrate: Germany is in the midst of a permanent cyber conflict – and SMEs are part of the attack surface. Companies that are not resilient could inadvertently become entangled in geopolitical conflicts.

In a world where cyberattacks are becoming increasingly frequent and sophisticated, information security and data protection are essential for organizations. The international standard ISO 27001 helps organizations reduce cyber risks using the ISO 27001 Controls from Annex A. Learn everything about the ISO 27001 Controls and how to successfully implement these measures.

IT service providers regularly process personal data as part of their operations—whether through storage in cloud services, access during technical support, or the extraction and analysis of data via specialized software. Because this access to personal data is so central to their work, data protection and GDPR compliance are of critical importance for IT service providers. We explain what you need to keep in mind.

Even today, executives are obliged to ensure IT security. However, with the new NIS2 directive, it becomes clear: responsibility unequivocally lies with management. Anyone who ignores obligations, fails to monitor measures, or foregoes training may be held personally liable. The NIS2 implementation act has been in force in Germany since December 6, 2025 – without a transition period. Learn everything about NIS2 liability in this article and why IT security is a top management priority.

NIS2 brings comprehensive cybersecurity requirements for companies. The following article outlines the obligations that affected organizations must meet as of December 6, 2025, and how your organization can efficiently master the EU's NIS2 requirements.

The EU has set the guardrails for the safe use of AI. However, companies should not rely solely on the AI Act but implement their own policies. Learn why AI governance is important and what role data protection plays in it.

ChatGPT is sparking global curiosity about Artificial Intelligence. Around 500 million people interact with the chatbot weekly. But with the hype, concerns from data protection experts are also growing. How secure is ChatGPT regarding data protection, and do companies have to forgo the AI tool?

it-sa 2025 in Nuremberg impressively demonstrated: Information security is no longer a theoretical exercise – it's a business-critical reality for German SMEs. Amidst crowded exhibition aisles and intense discussions, a clear picture emerged: companies are not looking for the perfect solution, but for pragmatic answers to urgent compliance questions. From NIS2 and digital sovereignty to AI governance – regulatory requirements are growing rapidly, while internal resources remain limited. This report summarizes the key findings of our panel discussion "Risk Exposure – What Does AI Really Change?" and provides concrete recommendations for SMEs.

Digitalization is bringing companies, customers, and service providers closer together. An increasing number of IT applications and data are migrating to the cloud. While this drives efficiency, it also introduces risks to data and systems. The Zero Trust principle is designed to mitigate these cyber risks.

The GDPR strengthens the right to erasure and the right to be forgotten for consumers in the EU: companies and search engine providers must delete personal data under certain conditions. Find out what these are and how to fulfill your obligations.

With an ISO risk assessment, IT and InfoSec managers lay the groundwork for an effective ISMS that protects their company from cyberattacks and data loss and helps meet GDPR and NIS2 requirements. In this practical guide, you will learn everything about ISO risk analysis and the role Annex A and the SoA play.

Anyone responsible for accounting within a company handles sensitive financial data on a daily basis. This makes data protection in accounting indispensable for any business. Learn how to keep your financial data GDPR-compliant, even as you increasingly digitize your accounting processes.

A cyberattack can cripple a business for the long term, affecting corporations and SMEs alike. Cyber resilience helps to limit damage and ensure business continuity. Learn how to build greater cyber resilience for your company.

Information security is relevant for all industries – the automotive industry, for example, agreed some time ago to adopt TISAX® certification to ensure consistent security standards. This article explains what this certification entails, what requirements companies must meet, and how much it costs.

When it comes to the security of IT systems and data, ISO 27001 and TISAX® are often mentioned. These are certifications that demonstrate your company takes cybersecurity and data protection seriously. We explain the basics of both standards and show you which one is truly relevant for your company.

Information security is relevant across all industries, and the automotive sector even has its own certification for companies that implement specific measures to protect information. This article breaks down the costs of this hallmark of cybersecurity.

Do you need to enter into SCCs because you transfer personal data to a non-European processor? In addition to SCCs, a TIA is now required for this. But what exactly is a Transfer Impact Assessment and how is it prepared? We explain.

Whether inpatient or outpatient care – we help you implement GDPR in your care facility. With advancing digitalization and new legal regulations such as the electronic patient file (ePA) and the Health Data Use Act (GDNG), the demands on care facilities are increasing. Data protection is an integral part of responsible care practice.

Pseudonymization and anonymization can simplify data protection compliance for companies. Yet, these two terms often still leave many questions unanswered. We’re here to clear things up.

Have you ever been a victim of identity theft? In the digital age, it happens faster than ever before. With inadequately protected data, it is easy for hackers to collect information and use it for malicious purposes.

With the tightening of the European General Data Protection Regulation, the obligation for regular reporting has indirectly fallen to company data protection officers.

Create your record of processing activities in a legally compliant and digital format.

Many companies are legally required to appoint a data protection officer, as mandated by the EU General Data Protection Regulation and the new Federal Data Protection Act. In fact, these new laws have expanded the number of companies obligated to fill this role. Consequently, the costs associated with data protection officers are becoming a relevant issue for an increasing number of businesses. Are you interested in comparing the costs of internal versus external data protection officers? Read on to learn more.

Informational self-determination is a topic that has become increasingly significant in the age of digitalization and information technology—long before the General Data Protection Regulation (GDPR) was ever introduced. We disclose our data every day: online, at work, at government offices, and when placing orders. Anyone who shops regularly on Amazon knows exactly how much data the company stores about them, and may well wonder who else is actually using that information behind the scenes.

The entry into force of the General Data Protection Regulation (GDPR) has created an urgent need for action for many agencies and companies. If you have not yet taken a closer look at data protection law and the legal requirements for data transfers via the internet, email, or fax: the stricter rules on data security and data transfers have been in effect since May 2018. But what exactly constitutes a data transfer?

Even before the GDPR, there were mandatory reporting and notification requirements for data breaches, both to data protection authorities and to the affected individuals. Neglecting these reporting obligations in the event of a data incident was already subject to fines. However, the GDPR, which has been in effect since May 25, 2018, imposes stricter requirements in this area, and the scope for fines has been increased drastically. Companies must pay closer attention to their protocols and procedures for reporting such breaches. Proactive action is required from businesses to meet these heightened demands in their day-to-day operations.

A wide range of data protection regulations is linked to the term "processing of personal data." Companies should therefore familiarize themselves with the concept of data processing and the underlying legal provisions in order to accurately fulfill their own data protection obligations and responsibilities.

Managing data subject requests is effortless with our privacy software.

Data security encompasses the protection of all data, while data privacy is a subset of this field, focusing specifically on the protection of personal data. To ensure both, it is recommended that companies establish a data security concept. Data security is an integral part of data privacy and describes a concrete approach for companies to comply with data protection laws, ensuring the necessary framework for the collection, processing, and use of personal data. Because data security and the broader field of data privacy are closely linked to corporate IT, this is often referred to as information security. A data security concept must be tailored to the individual needs of each company. We explain what you need to keep in mind.

When personal telecommunications data is stored by public authorities—or on their behalf—without a specific cause, this is referred to as data retention. As a precursor to telecommunications surveillance, data retention is one of the most controversial areas of data protection law. Corresponding legal provisions have been struck down multiple times by both the Federal Constitutional Court and the European Court of Justice.

Biometric data is a special category of personal data, which is why the General Data Protection Regulation (GDPR) also applies to photographers. Depending on the context in which it is practiced, photography constitutes the processing of personal data. We will clarify what you need to keep in mind regarding data protection and photography.

The Trade Regulation Act contains provisions regarding the processing of personal data. This has led some entrepreneurs and rights holders to assume that trade law serves as an original legal basis for data protection in Germany. However, the relevant provisions in the Trade Regulation Act are merely specifications and clarifications tailored specifically to personal data obtained in the context of trade-related permits.

Direct customer outreach, direct marketing, email marketing, or call center support – sales operations take many forms. However, data protection must never be neglected, as effective sales activities rely on personal data, which is directly protected under the General Data Protection Regulation (GDPR). Our data protection software, Proliance 360, helps you manage data protection in sales and marketing processes in a smart and transparent way. After all, as digitalization continues to advance, data protection must also be implemented in a forward-looking, digital manner.

For companies, knowledge is capital. These trade secrets have significant economic value and must not fall into the hands of unauthorized third parties. It is not just large corporations but also startups that possess sensitive trade secrets worthy of protection, which are subject to confidentiality requirements and can secure a competitive advantage. With the entry into force of the Trade Secret Act (GeschGehG), every company must demonstrate that it protects its know-how through measures that are both externally recognizable and appropriate.

Rapid technological development and globalization have led to the processing of increasingly vast and almost intangible amounts of data. The collection, processing, and exchange of personal data have grown immensely in recent years, posing ever-greater challenges for data protection. Consequently, companies must strictly adhere to specific legal requirements when handling data. Violations not only risk criminal sanctions but also result in a significant and lasting loss of trust among customers and employees. Particularly when using the internet, corporate data protection obligations often prove to be highly complex.

Data misuse occurs when personal data such as names, contact details, or account information is used against a person's will to commit potentially criminal acts. To protect personal and thus sensitive data from such misuse, there are, among other things, data protection laws and the General Data Protection Regulation (GDPR). This form of data misuse can take many different forms in practice and sometimes has serious consequences: from identity theft to corporate bankruptcy.

Data protection regulations impose numerous information obligations on both controllers and their respective data protection officers regarding supervisory authorities. The stricter European General Data Protection Regulation (GDPR), which came into effect in May 2018, further specifies these obligations. Not only will failures be subject to significantly higher fines in the future, but proper implementation of data protection also requires the ability to provide information at any time.

In an increasingly digitized world, passwords serve as the first line of defense for our personal data. But how secure are these traditional passwords really? Given the constant evolution of technology and the growing threat of cybercrime, it is essential to evaluate and understand various authentication methods.

IT companies are facing major challenges: cyber threats are growing, yet they cannot afford to fall behind in the digitalization race. Here is how data protection helps balance IT security with progress.

About half a year ago, the European Parliament and the European Council agreed on the proposal for the "EU AI Act". This is the world's first legislation to intensively address the regulation of Artificial Intelligence (AI).

The General Data Protection Regulation stipulates that individuals affected by data protection violations may have a right to damages. The European Court of Justice recently issued relevant rulings on this.

The BSI status report provides regular updates on the state of IT security in Germany. The latest report presents alarming findings. We have summarized the 5 most important takeaways and show you how to protect your company.

Are digitalization and data protection eternal antagonists? Digital processes generate floods of data, while data protection advocates for a frugal and minimalist approach, especially regarding personal information. Despite this apparent conflict, data protection and digitalization are more closely linked than they might seem.

Data protection and schools go hand in hand. School operations involve the processing of a significant amount of personal data. This article outlines the applicable laws and regulations.

The GDPR mandates data protection through technology design via privacy by design. Furthermore, privacy by default is intended to ensure data-friendly settings from the outset. In practice, this does not always work as intended.

How secure is the data you store in Google Drive? And can that security be improved? We have put together information and tips on Google Drive and data privacy to ensure your data stays truly secure.

The GDPR sets high standards for passwords. Password managers make it easy to keep track of numerous, complex passwords. Which password managers are recommended for businesses?

A Facebook business page is one of the most widely used social media marketing tools. Today, it is rare to find a company that doesn't maintain a Facebook presence. After all, the social network offers a practical and direct way to connect with customers and prospects—whether through regular company posts on current topics or targeted advertisements.

To improve processes, supply chains, or carbon footprints, companies need to collect data—but it only becomes truly efficient when that data is shared. What are the benefits and the hurdles? And what roles do platforms, the Data Act, and data protection officers play in this process?

Website operators must obtain user consent for storing and processing data when using Google Ads or Google Analytics. Since March 2024, the use of Google Consent Mode has been mandatory for them. We provide information on what this means for you in practice.

The European Union is currently working on a digital identity wallet. This will allow EU citizens to identify themselves more easily online and store important documents, such as ID cards or driver's licenses, in a digital format. The digital wallet will also be relevant for businesses. However, data protection advocates see more than just benefits in this development.

In today's digital era, external cyberattacks on companies are no longer unusual and are a well-known risk. Yet, despite all the justified fear of external threats, an increasingly underestimated risk is coming into focus: data theft from within the organization.

The ongoing digitalization of the healthcare sector, particularly regarding the handling of patient data on the electronic health card (eGK), raises important questions about data privacy in medicine.

Whether you are already using the Meta Pixel or are just planning to implement it, here you will find everything you need to know about the data protection requirements and how to use the Meta Pixel in a way that is as GDPR-compliant as possible.

For many privacy advocates, Meta is a red flag. It seems the Facebook parent company would rather pay fines than provide adequate protection for user data. In July 2023, Meta launched a new app: its latest venture is the Twitter clone "Threads." Potential users in Europe are still waiting for the app, though that is not (entirely) due to data protection concerns.

It is not just website and online shop operators who need to address data protection; app providers are also subject to the European Union's data privacy regulations. The GDPR imposes numerous obligations on business owners, including app operators, to protect the personal data of their users.

Using WhatsApp for business? From a data protection perspective, it’s not a great idea, as app providers are also subject to the GDPR. We highlight the risks and introduce popular messenger alternatives like Threema and Signal.

The CRM tool HubSpot is a valuable asset for companies in customer acquisition and sales. However, storing large amounts of personal data also raises data protection concerns. Read on to learn about the applicable regulations.

The EU General Data Protection Regulation (GDPR) fundamentally transformed data protection in 2018, imposing stricter obligations on companies that process and store personal data. In this article, we explain how the CJEU has interpreted the right of access to personal data and how you should handle these requests.

Aufmerksame Besitzer eines neuen Android-Gerätes haben es vielleicht schon entdeckt: die Suchmaschine Presearch als Alternative zu Google. Auch wenn die Bekanntheit und ihr Marktanteil noch sehr gering sind, ist das Auftauchen von Presearch auf dem Smartphone Grund genug, dass wir uns diese Suchmaschine hinsichtlich Datenschutz genauer anschauen.

Fingerprint devices are used in both private and professional settings, for example, to secure hardware. But what about data protection when it comes to these fingerprint scanners? And what other security concerns should be considered?

They really do still exist—clattering fax machines that are by no means confined to dusty offices. But what about the issue of data protection and faxing? Do they actually go together?

The electronic patient record, or ePA for short, is a divisive topic: will it give the German healthcare system a much-needed digital boost, or does it primarily pose a data privacy risk? We provide an overview of the digital patient record and data protection.

The German Telemedia Act (TMG) specifies the information companies must provide when conducting business publicly. This includes a legal notice (Impressum). Find out here who is required to provide a legal notice and how you can reliably fulfill these obligations.

The exhibition halls stood empty for a long time, but the current situation has encouraged exhibitors and entrepreneurs to meet in person once again. When doing so, it is essential to keep trade fair data protection in mind during customer acquisition. We show you what to look out for and how to easily implement these requirements.

Many employees are worried about being honest with their company doctor. What information are they actually allowed to share with your employer? We’ll clear things up.