Data Protection in Practice

The demands placed on data protection providers vary significantly from one company to another. While some primarily seek legal support, others also require assistance with documentation, internal processes, external data protection, or related compliance topics. For this reason, it's beneficial to examine the specialization of each provider closely. Not all providers offer the same range of services, and not every model is suitable for every company size. The following comparison of the best data protection providers highlights their key areas of focus and the types of companies they are best suited for.

German companies are looking to become more digitally independent from non-European cloud providers. To help them evaluate and compare the sovereignty of cloud services, the EU has established uniform standards through the SEAL framework. How practical is this rating scale for businesses, and what steps should be taken now?

An Information Security Management System (ISMS) allows you to systematically protect your organization's internal and external information from unauthorized access. This overview summarizes the key facts about ISMS and best practices for its implementation.

A robust Information Security Management System (ISMS) forms the backbone of an effective corporate security strategy. Learn how to implement such a system in your company to keep hackers at bay.

The GDPR is based on a simple principle: the higher the risk to the individuals involved, the more extensive the protective measures must be. Risk analysis is therefore the foundation for almost all data protection decisions within a company—from selecting technical measures and reporting data breaches to determining whether a data protection impact assessment is required. This article explains how it works in practice.

When employees submit their resignation, employers must not only manage succession planning but also ensure the data protection-compliant handling of personal employee data. Otherwise, there's a risk of violating the GDPR. Read all about the obligations, deadlines, and how to properly carry out data deletion.

Data security and data protection are not synonyms, but two important tasks for companies. Learn how to clearly distinguish between both areas and implement them efficiently.

If you are searching for "terms and conditions privacy policy," you are usually looking for two things: legal clarity and a practical solution. In practice, the rule is almost always the same: terms and conditions, privacy policies, and terms of use are distinct legal instruments—each with different requirements regarding content, presentation, and implementation.

The General Data Protection Regulation (GDPR) requires companies to implement technical and organizational measures (TOMs) to ensure the secure processing of personal data. TOMs are the foundation of any GDPR-compliant data processing. In this guide, you will learn which measures are mandatory, how the 14 control areas work, and how to document your TOMs in a legally compliant manner—including practical tips for remote work and data processing agreements.

In large companies and corporations in particular, data protection can quickly become complex. The GDPR allows organizations to appoint a group data protection officer to ensure consistent data protection standards across the entire group.

A Data Protection Officer ensures that companies securely meet GDPR requirements and protects against data breaches. But what if incidents still occur, or the supervisory authority suddenly imposes fines? This article shows which mistakes you should avoid when working with Data Protection Officers.

Are you looking to appoint a data protection officer for your company and wondering if your candidate truly possesses the specialized knowledge, IT expertise, and experience your business requires? Discover which qualifications are essential for a DPO’s responsibilities, when a legal expert is a better fit than an IT specialist, and what it takes to ensure your data protection is not only compliant but also efficient.

What is a GDPR data protection officer, and how do internal data protection experts differ from other roles? This article provides clarity.

WeTransfer is a popular online service for sending large file attachments – but what about data protection? Discussions surrounding access rights in the terms and conditions and data storage on US servers raise important questions for compliance officers. This article provides a GDPR compliance check and demonstrates how SwissTransfer performs as a data protection-compliant alternative.

The use of AI tools is a massive trend in the workplace – but with innovation comes responsibility: data protection and GDPR compliance must be a top priority for companies using artificial intelligence. Those who deploy AI solutions like ChatGPT, Copilot, or Google Gemini need to understand how these systems handle personal and sensitive data. The central question is: Which of these AI tools meets European data protection requirements – and where do risks lurk? In the following overview, you will learn how ChatGPT, Microsoft Copilot, and Google Gemini fare regarding GDPR. We will also examine key topics such as data minimization, transparency, controllability, risk assessment, and accountability – and present DeepSeek as a negative example of GDPR violations.

Google continues to dominate the global search engine market with a share of around 92% – but awareness of data protection and compliance requirements has fundamentally changed. For compliance officers in medium-sized companies, the question increasingly arises: How can we ensure secure, GDPR-compliant search processes? This article introduces 7 data protection-compliant search engine alternatives.

After years of criticism from data protection authorities, Google is taking action: starting April 2, 2026, Google will process reCAPTCHA data under a data processing agreement (DPA). This article explains what this means for your company and the steps you need to take now.

Internal data protection officers benefit from special protection against dismissal, which presents many employers with legal challenges. This article explains when termination is possible, how it differs from removal from office, and what alternatives are available.

NIS2 requires supply chain security, GDPR demands transparent data processing, and DORA targets ICT security in the financial sector. Those who don't fully control their IT systems and data will struggle to meet these regulations. Digital sovereignty is therefore no longer a nice-to-have, but a prerequisite for demonstrable compliance.

ChatGPT is sparking global curiosity about Artificial Intelligence. Around 500 million people interact with the chatbot weekly. But with the hype, concerns from data protection experts are also growing. How secure is ChatGPT regarding data protection, and do companies have to forgo the AI tool?

Digitalization is bringing companies, customers, and service providers closer together. An increasing number of IT applications and data are migrating to the cloud. While this drives efficiency, it also introduces risks to data and systems. The Zero Trust principle is designed to mitigate these cyber risks.

Anyone responsible for accounting within a company handles sensitive financial data on a daily basis. This makes data protection in accounting indispensable for any business. Learn how to keep your financial data GDPR-compliant, even as you increasingly digitize your accounting processes.

Do you need to enter into SCCs because you transfer personal data to a non-European processor? In addition to SCCs, a TIA is now required for this. But what exactly is a Transfer Impact Assessment and how is it prepared? We explain.

Whether inpatient or outpatient care – we help you implement GDPR in your care facility. With advancing digitalization and new legal regulations such as the electronic patient file (ePA) and the Health Data Use Act (GDNG), the demands on care facilities are increasing. Data protection is an integral part of responsible care practice.

Have you ever been a victim of identity theft? In the digital age, it happens faster than ever before. With inadequately protected data, it is easy for hackers to collect information and use it for malicious purposes.

With the tightening of the European General Data Protection Regulation, the obligation for regular reporting has indirectly fallen to company data protection officers.

Create your record of processing activities in a legally compliant and digital format.

Informational self-determination is a topic that has become increasingly significant in the age of digitalization and information technology—long before the General Data Protection Regulation (GDPR) was ever introduced. We disclose our data every day: online, at work, at government offices, and when placing orders. Anyone who shops regularly on Amazon knows exactly how much data the company stores about them, and may well wonder who else is actually using that information behind the scenes.

Even before the GDPR, there were mandatory reporting and notification requirements for data breaches, both to data protection authorities and to the affected individuals. Neglecting these reporting obligations in the event of a data incident was already subject to fines. However, the GDPR, which has been in effect since May 25, 2018, imposes stricter requirements in this area, and the scope for fines has been increased drastically. Companies must pay closer attention to their protocols and procedures for reporting such breaches. Proactive action is required from businesses to meet these heightened demands in their day-to-day operations.

Managing data subject requests is effortless with our privacy software.

Data security encompasses the protection of all data, while data privacy is a subset of this field, focusing specifically on the protection of personal data. To ensure both, it is recommended that companies establish a data security concept. Data security is an integral part of data privacy and describes a concrete approach for companies to comply with data protection laws, ensuring the necessary framework for the collection, processing, and use of personal data. Because data security and the broader field of data privacy are closely linked to corporate IT, this is often referred to as information security. A data security concept must be tailored to the individual needs of each company. We explain what you need to keep in mind.

Biometric data is a special category of personal data, which is why the General Data Protection Regulation (GDPR) also applies to photographers. Depending on the context in which it is practiced, photography constitutes the processing of personal data. We will clarify what you need to keep in mind regarding data protection and photography.

The Trade Regulation Act contains provisions regarding the processing of personal data. This has led some entrepreneurs and rights holders to assume that trade law serves as an original legal basis for data protection in Germany. However, the relevant provisions in the Trade Regulation Act are merely specifications and clarifications tailored specifically to personal data obtained in the context of trade-related permits.

Direct customer outreach, direct marketing, email marketing, or call center support – sales operations take many forms. However, data protection must never be neglected, as effective sales activities rely on personal data, which is directly protected under the General Data Protection Regulation (GDPR). Our data protection software, Proliance 360, helps you manage data protection in sales and marketing processes in a smart and transparent way. After all, as digitalization continues to advance, data protection must also be implemented in a forward-looking, digital manner.

For companies, knowledge is capital. These trade secrets have significant economic value and must not fall into the hands of unauthorized third parties. It is not just large corporations but also startups that possess sensitive trade secrets worthy of protection, which are subject to confidentiality requirements and can secure a competitive advantage. With the entry into force of the Trade Secret Act (GeschGehG), every company must demonstrate that it protects its know-how through measures that are both externally recognizable and appropriate.

Rapid technological development and globalization have led to the processing of increasingly vast and almost intangible amounts of data. The collection, processing, and exchange of personal data have grown immensely in recent years, posing ever-greater challenges for data protection. Consequently, companies must strictly adhere to specific legal requirements when handling data. Violations not only risk criminal sanctions but also result in a significant and lasting loss of trust among customers and employees. Particularly when using the internet, corporate data protection obligations often prove to be highly complex.

In an increasingly digitized world, passwords serve as the first line of defense for our personal data. But how secure are these traditional passwords really? Given the constant evolution of technology and the growing threat of cybercrime, it is essential to evaluate and understand various authentication methods.

IT companies are facing major challenges: cyber threats are growing, yet they cannot afford to fall behind in the digitalization race. Here is how data protection helps balance IT security with progress.

About half a year ago, the European Parliament and the European Council agreed on the proposal for the "EU AI Act". This is the world's first legislation to intensively address the regulation of Artificial Intelligence (AI).

The BSI status report provides regular updates on the state of IT security in Germany. The latest report presents alarming findings. We have summarized the 5 most important takeaways and show you how to protect your company.

Data protection and schools go hand in hand. School operations involve the processing of a significant amount of personal data. This article outlines the applicable laws and regulations.

How secure is the data you store in Google Drive? And can that security be improved? We have put together information and tips on Google Drive and data privacy to ensure your data stays truly secure.

The GDPR sets high standards for passwords. Password managers make it easy to keep track of numerous, complex passwords. Which password managers are recommended for businesses?

A Facebook business page is one of the most widely used social media marketing tools. Today, it is rare to find a company that doesn't maintain a Facebook presence. After all, the social network offers a practical and direct way to connect with customers and prospects—whether through regular company posts on current topics or targeted advertisements.

To improve processes, supply chains, or carbon footprints, companies need to collect data—but it only becomes truly efficient when that data is shared. What are the benefits and the hurdles? And what roles do platforms, the Data Act, and data protection officers play in this process?

Website operators must obtain user consent for storing and processing data when using Google Ads or Google Analytics. Since March 2024, the use of Google Consent Mode has been mandatory for them. We provide information on what this means for you in practice.

The European Union is currently working on a digital identity wallet. This will allow EU citizens to identify themselves more easily online and store important documents, such as ID cards or driver's licenses, in a digital format. The digital wallet will also be relevant for businesses. However, data protection advocates see more than just benefits in this development.

In today's digital era, external cyberattacks on companies are no longer unusual and are a well-known risk. Yet, despite all the justified fear of external threats, an increasingly underestimated risk is coming into focus: data theft from within the organization.

The ongoing digitalization of the healthcare sector, particularly regarding the handling of patient data on the electronic health card (eGK), raises important questions about data privacy in medicine.

Whether you are already using the Meta Pixel or are just planning to implement it, here you will find everything you need to know about the data protection requirements and how to use the Meta Pixel in a way that is as GDPR-compliant as possible.

It is not just website and online shop operators who need to address data protection; app providers are also subject to the European Union's data privacy regulations. The GDPR imposes numerous obligations on business owners, including app operators, to protect the personal data of their users.

Using WhatsApp for business? From a data protection perspective, it’s not a great idea, as app providers are also subject to the GDPR. We highlight the risks and introduce popular messenger alternatives like Threema and Signal.

The CRM tool HubSpot is a valuable asset for companies in customer acquisition and sales. However, storing large amounts of personal data also raises data protection concerns. Read on to learn about the applicable regulations.

The EU General Data Protection Regulation (GDPR) fundamentally transformed data protection in 2018, imposing stricter obligations on companies that process and store personal data. In this article, we explain how the CJEU has interpreted the right of access to personal data and how you should handle these requests.

Aufmerksame Besitzer eines neuen Android-Gerätes haben es vielleicht schon entdeckt: die Suchmaschine Presearch als Alternative zu Google. Auch wenn die Bekanntheit und ihr Marktanteil noch sehr gering sind, ist das Auftauchen von Presearch auf dem Smartphone Grund genug, dass wir uns diese Suchmaschine hinsichtlich Datenschutz genauer anschauen.

Fingerprint devices are used in both private and professional settings, for example, to secure hardware. But what about data protection when it comes to these fingerprint scanners? And what other security concerns should be considered?

The electronic patient record, or ePA for short, is a divisive topic: will it give the German healthcare system a much-needed digital boost, or does it primarily pose a data privacy risk? We provide an overview of the digital patient record and data protection.

The German Telemedia Act (TMG) specifies the information companies must provide when conducting business publicly. This includes a legal notice (Impressum). Find out here who is required to provide a legal notice and how you can reliably fulfill these obligations.

Many employees are worried about being honest with their company doctor. What information are they actually allowed to share with your employer? We’ll clear things up.

Have you been selected to participate in the microcensus? Is participation mandatory, or can you opt out? You can find all the key facts on the subject here.

Data protection often ends where online contact forms begin. The principle of data minimization, in particular, is frequently nowhere to be found. For website operators, this can quickly become expensive, as it carries the risk of significant fines.

Many companies rely on one or even several data processors in their day-to-day operations. These processors should be audited regularly to ensure that an adequate level of data protection is maintained. We outline the key points that must be considered when auditing your data processors. 

Appointing a data protection officer is essential for any company. However, it is crucial to mitigate the risk of a conflict of interest when making this decision. Read on to find out what you need to consider.

Does the right to be forgotten apply to Google? There have been various rulings regarding the right to have search queries removed from Google, ranging from the dismissal of cases to the imposition of fines.

Mobile Device Management (MDM) solutions help companies easily implement various GDPR requirements. Our partner Lendis explains what you need to know.

IT maintenance is often carried out via remote access. Companies, in particular, must strictly adhere to data protection regulations in the process. What does the GDPR stipulate regarding remote maintenance?

To conclude a rental agreement, it is necessary to collect personal data. There are several important points for both tenants and landlords to consider. We have outlined the key rights and obligations regarding data protection.

Data processing abroad is a critical issue. What must be considered when company employees process or access personal data while visiting insecure third countries?

Virtual Private Networks (VPNs) enhance security and privacy online, both at work and in your personal life. But what exactly does that mean, and which aspects of data protection are involved? We’ll break it down for you.

Regular driver's license checks by the employer: While this is standard practice for companies with large vehicle fleets, it is worth taking a closer look at the legal foundations. In the following article, we summarize the basis for these checks and what you need to know from a data protection perspective when creating the corresponding records.

"Klingelgate." A welcome nuisance. Another reason to rail against the GDPR. So, the General Data Protection Regulation is now stripping citizens of their nameplates—or is it? No, because nameplates don't actually fall under the GDPR, but it certainly made for some great outrage. Aunt Erna will be pleased.

Telegram has long been considered a secure alternative to WhatsApp and similar apps because it does not require a phone number. However, this enthusiasm waned as more radical groups began using the platform for bot services and planning criminal activities. Criticism regarding data privacy has also grown louder; learn more about Telegram's data privacy practices here.

How are data managed after a person's death? This is known as post-mortem data protection. Find out here what steps need to be taken to manage the data of a deceased person.

As of January 1, 2022, electronic prescriptions are mandatory in all medical practices. However, e-prescriptions have also raised concerns regarding the sensitive data stored within them. Read on to learn how e-prescriptions align with data protection standards.

Medical appointment booking portals promise users a simple and straightforward way to schedule and manage doctor visits. Recently, the booking platform Doctolib has come under scrutiny by the Berlin Commissioner for Data Protection. This raises the question: is sensitive data being adequately protected, and what should we as consumers keep in mind when booking appointments online?

Video surveillance in the workplace is a hotly debated topic that concerns both employers and employees—and occasionally even ends up in court. What is the legal situation here? And why is camera surveillance in the workplace problematic under data protection law?

Online networks like LinkedIn make it easier to build and maintain professional connections. However, the information users are required to provide is usually personal data and should be protected accordingly.

Artificial intelligence and machine learning allow us to age, look younger, or appear in videos we never knew existed. This is all known as deepfaking. But what does this mean for data protection?

Data protection and staff scheduling can be a tricky combination: as a general rule, duty rosters containing full names may no longer be posted in the workplace. However, there are simple ways to ensure that schedules remain accessible to all employees.

Pre-employment screening is an attractive method for companies to make the applicant vetting process more effective. As an HR professional, you should be aware of the data protection regulations in place to ensure you remain on the safe side legally. Our tips are here to help you navigate this.

Third-party cookies, which are set when visiting almost any website, are set to be phased out. This poses a problem for many advertisers, as cookie-based tracking is a massive market. So, what is the alternative? And is it more compliant with data protection regulations?

Smooth operations and a positive work environment are the foundation of a successful business. Employee surveys can provide valuable insights into these areas. Here is what employers should know.

It’s not just during the pre-Christmas rush that online shopping surges. However, shopping online can become problematic if consumers end up on shady websites. Here is what you should look out for when shopping online and how to spot dangerous fake shops.

Due to the COVID-19 pandemic, the video conferencing tool Zoom gained more than 150 million new users almost overnight. Internet trolls looking to exploit the situation were quick to act, leading to the rise of what is known as "Zoombombing."

Videos are one of the most important means of communication today, and YouTube is one of the largest video platforms in existence. But how does YouTube handle data privacy and GDPR compliance?

Determining the data protection status of freelancers can often be tricky. We will show you how to clarify exactly what data protection requirements apply to "your" freelancers.

Is Signal a secure messenger? As an alternative to the market leader WhatsApp, Signal is becoming increasingly popular. But how does Signal stack up when it comes to data privacy, GDPR, and related issues?

When many team members work remotely, scheduling via a polling tool is often the easiest approach. Here is what you should definitely keep in mind when using these tools within your company.

What will I look like when I’m old? Should I get preventative fillers for any potential wrinkles? To answer these questions, FaceApp helps with digital aging. However, what the app does with the data provided and the state of FaceApp’s data privacy is alarming.

Is the GDPR the modern-day Christmas Grinch? Not at all, because sending Christmas cards and other holiday greetings is still perfectly fine. Most of the time, anyway.

To ensure that data protection remains a priority during digital work—even in times of COVID-19 and widespread remote work—we have compiled the best data privacy tips for screensharing.