Sabrina Schaub

Ihr ISO 27001-Audit steht bevor, die NIS2-Umsetzung ist beschlossen, Ihr VVT ist auf dem aktuellen Stand – und jetzt das: Mit dem „Digitalen Omnibus“ hat die EU-Kommission ein Gesetzespaket vorgelegt, das zentrale Säulen des Datenschutz- und Compliance-Managements von KMU verändern könnte und auch KI-Regeln betrifft.

German companies are looking to become more digitally independent from non-European cloud providers. To help them evaluate and compare the sovereignty of cloud services, the EU has established uniform standards through the SEAL framework. How practical is this rating scale for businesses, and what steps should be taken now?

Managing all requirements and documentation across GDPR, NIS2, and AI compliance is a particular challenge, especially for SMEs. Many companies still manage their compliance data and tasks manually in spreadsheets. In day-to-day operations, it's easy to quickly lose track of time and a clear overview. A GRC platform eases the burden, but is it the right solution for SMEs?

The NIS2 Implementation Act has been in force since December 6, 2025. From now on, compliance officers must report significant security incidents within 24 hours. This guide shows you what other deadlines apply and how to safely meet them in an emergency.

A GDPR data protection audit offers small and medium-sized enterprises (SMEs) the opportunity to voluntarily have their data protection compliance reviewed and to demonstrate it externally through a certificate. Find out what to expect during preparation and the audit process.

As an autonomous AI agent, OpenClaw promises efficiency and relief in everyday work. In practice, however, this primarily creates new risks for information security and data protection. Because in order to carry out tasks independently, the agent needs extensive access rights. We will clarify whether it is currently advisable to use OpenClaw in the company.

Data security and data protection are not synonyms, but two important tasks for companies. Learn how to clearly distinguish between both areas and implement them efficiently.

A Data Protection Officer ensures that companies securely meet GDPR requirements and protects against data breaches. But what if incidents still occur, or the supervisory authority suddenly imposes fines? This article shows which mistakes you should avoid when working with Data Protection Officers.

Companies that use Artificial Intelligence (AI) need effective AI governance. AI usage policies play a central role: they clearly show employees the benefits and limitations of the technology and how to work safely with AI. Our guide provides tips on how to create your own AI Policy.

Storing personal data – but for how long? This question arises daily in companies: On the one hand, the GDPR requires data to be deleted as soon as the processing purpose ceases. On the other hand, there are statutory retention obligations and periods from the German Commercial Code (HGB), Tax Code (AO), or Income Tax Act (EStG) that mandate longer storage. This guide shows you how to meet both requirements, avoid fines, and maintain an overview.

NIS2 requires supply chain security, GDPR demands transparent data processing, and DORA targets ICT security in the financial sector. Those who don't fully control their IT systems and data will struggle to meet these regulations. Digital sovereignty is therefore no longer a nice-to-have, but a prerequisite for demonstrable compliance.

Hybrid attacks, political tensions, and sabotage demonstrate: Germany is in the midst of a permanent cyber conflict – and SMEs are part of the attack surface. Companies that are not resilient could inadvertently become entangled in geopolitical conflicts.

In a world where cyberattacks are becoming increasingly frequent and sophisticated, information security and data protection are essential for organizations. The international standard ISO 27001 helps organizations reduce cyber risks using the ISO 27001 Controls from Annex A. Learn everything about the ISO 27001 Controls and how to successfully implement these measures.

Even today, executives are obliged to ensure IT security. However, with the new NIS2 directive, it becomes clear: responsibility unequivocally lies with management. Anyone who ignores obligations, fails to monitor measures, or foregoes training may be held personally liable. The NIS2 implementation act has been in force in Germany since December 6, 2025 – without a transition period. Learn everything about NIS2 liability in this article and why IT security is a top management priority.

The EU has set the guardrails for the safe use of AI. However, companies should not rely solely on the AI Act but implement their own policies. Learn why AI governance is important and what role data protection plays in it.

ChatGPT is sparking global curiosity about Artificial Intelligence. Around 500 million people interact with the chatbot weekly. But with the hype, concerns from data protection experts are also growing. How secure is ChatGPT regarding data protection, and do companies have to forgo the AI tool?

With an ISO risk assessment, IT and InfoSec managers lay the groundwork for an effective ISMS that protects their company from cyberattacks and data loss and helps meet GDPR and NIS2 requirements. In this practical guide, you will learn everything about ISO risk analysis and the role Annex A and the SoA play.

When it comes to the security of IT systems and data, ISO 27001 and TISAX® are often mentioned. These are certifications that demonstrate your company takes cybersecurity and data protection seriously. We explain the basics of both standards and show you which one is truly relevant for your company.

About half a year ago, the European Parliament and the European Council agreed on the proposal for the "EU AI Act". This is the world's first legislation to intensively address the regulation of Artificial Intelligence (AI).

The General Data Protection Regulation stipulates that individuals affected by data protection violations may have a right to damages. The European Court of Justice recently issued relevant rulings on this.