Ivona Simic

How much does ISO 27001 certification truly cost? The answer depends on company size, maturity level, and scope – and therefore varies widely. Only looking at the audit underestimates the total costs. This article outlines all relevant cost components, typical price ranges by company size, and the most important levers to strategically manage effort and budget.

The demands placed on data protection providers vary significantly from one company to another. While some primarily seek legal support, others also require assistance with documentation, internal processes, external data protection, or related compliance topics. For this reason, it's beneficial to examine the specialization of each provider closely. Not all providers offer the same range of services, and not every model is suitable for every company size. The following comparison of the best data protection providers highlights their key areas of focus and the types of companies they are best suited for.

As the use of artificial intelligence (AI) in businesses increases, so does the need for clear legal rules. Since August 2024, the European Union's AI Act has provided a legal framework for the regulated and secure use of AI systems in the EU. The AI Regulation (AI-VO) came into force on August 1, 2024 – with staggered transitional periods until 2027. In this article, you will learn about the specific requirements your company will face and how to minimize compliance risks.

The GDPR requires companies to systematically and rule-based delete data that is no longer needed. A data deletion policy defines what data is deleted when, who is responsible for it, and how exceptions are handled. Learn what a complete data deletion policy must contain and how to implement it efficiently.

If you are searching for "terms and conditions privacy policy," you are usually looking for two things: legal clarity and a practical solution. In practice, the rule is almost always the same: terms and conditions, privacy policies, and terms of use are distinct legal instruments—each with different requirements regarding content, presentation, and implementation.

The General Data Protection Regulation (GDPR) requires companies to implement technical and organizational measures (TOMs) to ensure the secure processing of personal data. TOMs are the foundation of any GDPR-compliant data processing. In this guide, you will learn which measures are mandatory, how the 14 control areas work, and how to document your TOMs in a legally compliant manner—including practical tips for remote work and data processing agreements.

WeTransfer is a popular online service for sending large file attachments – but what about data protection? Discussions surrounding access rights in the terms and conditions and data storage on US servers raise important questions for compliance officers. This article provides a GDPR compliance check and demonstrates how SwissTransfer performs as a data protection-compliant alternative.

The use of AI tools is a massive trend in the workplace – but with innovation comes responsibility: data protection and GDPR compliance must be a top priority for companies using artificial intelligence. Those who deploy AI solutions like ChatGPT, Copilot, or Google Gemini need to understand how these systems handle personal and sensitive data. The central question is: Which of these AI tools meets European data protection requirements – and where do risks lurk? In the following overview, you will learn how ChatGPT, Microsoft Copilot, and Google Gemini fare regarding GDPR. We will also examine key topics such as data minimization, transparency, controllability, risk assessment, and accountability – and present DeepSeek as a negative example of GDPR violations.

Google continues to dominate the global search engine market with a share of around 92% – but awareness of data protection and compliance requirements has fundamentally changed. For compliance officers in medium-sized companies, the question increasingly arises: How can we ensure secure, GDPR-compliant search processes? This article introduces 7 data protection-compliant search engine alternatives.

After years of criticism from data protection authorities, Google is taking action: starting April 2, 2026, Google will process reCAPTCHA data under a data processing agreement (DPA). This article explains what this means for your company and the steps you need to take now.

it-sa 2025 in Nuremberg impressively demonstrated: Information security is no longer a theoretical exercise – it's a business-critical reality for German SMEs. Amidst crowded exhibition aisles and intense discussions, a clear picture emerged: companies are not looking for the perfect solution, but for pragmatic answers to urgent compliance questions. From NIS2 and digital sovereignty to AI governance – regulatory requirements are growing rapidly, while internal resources remain limited. This report summarizes the key findings of our panel discussion "Risk Exposure – What Does AI Really Change?" and provides concrete recommendations for SMEs.

Information security is relevant for all industries – the automotive industry, for example, agreed some time ago to adopt TISAX® certification to ensure consistent security standards. This article explains what this certification entails, what requirements companies must meet, and how much it costs.