GDPR & Legal

The GDPR strengthens the right to erasure and the right to be forgotten for consumers in the EU: companies and search engine providers must delete personal data under certain conditions. Find out what these are and how to fulfill your obligations.

A GDPR data protection audit offers small and medium-sized enterprises (SMEs) the opportunity to voluntarily have their data protection compliance reviewed and to demonstrate it externally through a certificate. Find out what to expect during preparation and the audit process.

The GDPR requires companies to systematically and rule-based delete data that is no longer needed. A data deletion policy defines what data is deleted when, who is responsible for it, and how exceptions are handled. Learn what a complete data deletion policy must contain and how to implement it efficiently.

When employees submit their resignation, employers must not only manage succession planning but also ensure the data protection-compliant handling of personal employee data. Otherwise, there's a risk of violating the GDPR. Read all about the obligations, deadlines, and how to properly carry out data deletion.

If external service providers process personal data on behalf of your company, the GDPR requires you to enter into a contract with them that sets out the terms and conditions for this processing. Learn what a data processing agreement (DPA) entails and why it is essential for your business.

If you are searching for "terms and conditions privacy policy," you are usually looking for two things: legal clarity and a practical solution. In practice, the rule is almost always the same: terms and conditions, privacy policies, and terms of use are distinct legal instruments—each with different requirements regarding content, presentation, and implementation.

A Data Protection Officer ensures that companies securely meet GDPR requirements and protects against data breaches. But what if incidents still occur, or the supervisory authority suddenly imposes fines? This article shows which mistakes you should avoid when working with Data Protection Officers.

What is a GDPR data protection officer, and how do internal data protection experts differ from other roles? This article provides clarity.

Data protection officers aren't just found in private companies. At the state and federal level, there are also federal and state data protection commissioners. Find out why your data protection officer should be familiar with these authorities.

WeTransfer is a popular online service for sending large file attachments – but what about data protection? Discussions surrounding access rights in the terms and conditions and data storage on US servers raise important questions for compliance officers. This article provides a GDPR compliance check and demonstrates how SwissTransfer performs as a data protection-compliant alternative.

Storing personal data – but for how long? This question arises daily in companies: On the one hand, the GDPR requires data to be deleted as soon as the processing purpose ceases. On the other hand, there are statutory retention obligations and periods from the German Commercial Code (HGB), Tax Code (AO), or Income Tax Act (EStG) that mandate longer storage. This guide shows you how to meet both requirements, avoid fines, and maintain an overview.

The use of AI tools is a massive trend in the workplace – but with innovation comes responsibility: data protection and GDPR compliance must be a top priority for companies using artificial intelligence. Those who deploy AI solutions like ChatGPT, Copilot, or Google Gemini need to understand how these systems handle personal and sensitive data. The central question is: Which of these AI tools meets European data protection requirements – and where do risks lurk? In the following overview, you will learn how ChatGPT, Microsoft Copilot, and Google Gemini fare regarding GDPR. We will also examine key topics such as data minimization, transparency, controllability, risk assessment, and accountability – and present DeepSeek as a negative example of GDPR violations.

Google continues to dominate the global search engine market with a share of around 92% – but awareness of data protection and compliance requirements has fundamentally changed. For compliance officers in medium-sized companies, the question increasingly arises: How can we ensure secure, GDPR-compliant search processes? This article introduces 7 data protection-compliant search engine alternatives.

After years of criticism from data protection authorities, Google is taking action: starting April 2, 2026, Google will process reCAPTCHA data under a data processing agreement (DPA). This article explains what this means for your company and the steps you need to take now.

Internal data protection officers benefit from special protection against dismissal, which presents many employers with legal challenges. This article explains when termination is possible, how it differs from removal from office, and what alternatives are available.

IT service providers regularly process personal data as part of their operations—whether through storage in cloud services, access during technical support, or the extraction and analysis of data via specialized software. Because this access to personal data is so central to their work, data protection and GDPR compliance are of critical importance for IT service providers. We explain what you need to keep in mind.

ChatGPT is sparking global curiosity about Artificial Intelligence. Around 500 million people interact with the chatbot weekly. But with the hype, concerns from data protection experts are also growing. How secure is ChatGPT regarding data protection, and do companies have to forgo the AI tool?

Do you need to enter into SCCs because you transfer personal data to a non-European processor? In addition to SCCs, a TIA is now required for this. But what exactly is a Transfer Impact Assessment and how is it prepared? We explain.

Whether inpatient or outpatient care – we help you implement GDPR in your care facility. With advancing digitalization and new legal regulations such as the electronic patient file (ePA) and the Health Data Use Act (GDNG), the demands on care facilities are increasing. Data protection is an integral part of responsible care practice.

Pseudonymization and anonymization can simplify data protection compliance for companies. Yet, these two terms often still leave many questions unanswered. We’re here to clear things up.

Have you ever been a victim of identity theft? In the digital age, it happens faster than ever before. With inadequately protected data, it is easy for hackers to collect information and use it for malicious purposes.

Create your record of processing activities in a legally compliant and digital format.

Informational self-determination is a topic that has become increasingly significant in the age of digitalization and information technology—long before the General Data Protection Regulation (GDPR) was ever introduced. We disclose our data every day: online, at work, at government offices, and when placing orders. Anyone who shops regularly on Amazon knows exactly how much data the company stores about them, and may well wonder who else is actually using that information behind the scenes.

The entry into force of the General Data Protection Regulation (GDPR) has created an urgent need for action for many agencies and companies. If you have not yet taken a closer look at data protection law and the legal requirements for data transfers via the internet, email, or fax: the stricter rules on data security and data transfers have been in effect since May 2018. But what exactly constitutes a data transfer?

A wide range of data protection regulations is linked to the term "processing of personal data." Companies should therefore familiarize themselves with the concept of data processing and the underlying legal provisions in order to accurately fulfill their own data protection obligations and responsibilities.

Managing data subject requests is effortless with our privacy software.

When personal telecommunications data is stored by public authorities—or on their behalf—without a specific cause, this is referred to as data retention. As a precursor to telecommunications surveillance, data retention is one of the most controversial areas of data protection law. Corresponding legal provisions have been struck down multiple times by both the Federal Constitutional Court and the European Court of Justice.

Biometric data is a special category of personal data, which is why the General Data Protection Regulation (GDPR) also applies to photographers. Depending on the context in which it is practiced, photography constitutes the processing of personal data. We will clarify what you need to keep in mind regarding data protection and photography.

Direct customer outreach, direct marketing, email marketing, or call center support – sales operations take many forms. However, data protection must never be neglected, as effective sales activities rely on personal data, which is directly protected under the General Data Protection Regulation (GDPR). Our data protection software, Proliance 360, helps you manage data protection in sales and marketing processes in a smart and transparent way. After all, as digitalization continues to advance, data protection must also be implemented in a forward-looking, digital manner.

Rapid technological development and globalization have led to the processing of increasingly vast and almost intangible amounts of data. The collection, processing, and exchange of personal data have grown immensely in recent years, posing ever-greater challenges for data protection. Consequently, companies must strictly adhere to specific legal requirements when handling data. Violations not only risk criminal sanctions but also result in a significant and lasting loss of trust among customers and employees. Particularly when using the internet, corporate data protection obligations often prove to be highly complex.

Data protection regulations impose numerous information obligations on both controllers and their respective data protection officers regarding supervisory authorities. The stricter European General Data Protection Regulation (GDPR), which came into effect in May 2018, further specifies these obligations. Not only will failures be subject to significantly higher fines in the future, but proper implementation of data protection also requires the ability to provide information at any time.

About half a year ago, the European Parliament and the European Council agreed on the proposal for the "EU AI Act". This is the world's first legislation to intensively address the regulation of Artificial Intelligence (AI).

The General Data Protection Regulation stipulates that individuals affected by data protection violations may have a right to damages. The European Court of Justice recently issued relevant rulings on this.

Data protection and schools go hand in hand. School operations involve the processing of a significant amount of personal data. This article outlines the applicable laws and regulations.

The GDPR mandates data protection through technology design via privacy by design. Furthermore, privacy by default is intended to ensure data-friendly settings from the outset. In practice, this does not always work as intended.

How secure is the data you store in Google Drive? And can that security be improved? We have put together information and tips on Google Drive and data privacy to ensure your data stays truly secure.

A Facebook business page is one of the most widely used social media marketing tools. Today, it is rare to find a company that doesn't maintain a Facebook presence. After all, the social network offers a practical and direct way to connect with customers and prospects—whether through regular company posts on current topics or targeted advertisements.

To improve processes, supply chains, or carbon footprints, companies need to collect data—but it only becomes truly efficient when that data is shared. What are the benefits and the hurdles? And what roles do platforms, the Data Act, and data protection officers play in this process?

Website operators must obtain user consent for storing and processing data when using Google Ads or Google Analytics. Since March 2024, the use of Google Consent Mode has been mandatory for them. We provide information on what this means for you in practice.

The European Union is currently working on a digital identity wallet. This will allow EU citizens to identify themselves more easily online and store important documents, such as ID cards or driver's licenses, in a digital format. The digital wallet will also be relevant for businesses. However, data protection advocates see more than just benefits in this development.

In today's digital era, external cyberattacks on companies are no longer unusual and are a well-known risk. Yet, despite all the justified fear of external threats, an increasingly underestimated risk is coming into focus: data theft from within the organization.

The ongoing digitalization of the healthcare sector, particularly regarding the handling of patient data on the electronic health card (eGK), raises important questions about data privacy in medicine.

Whether you are already using the Meta Pixel or are just planning to implement it, here you will find everything you need to know about the data protection requirements and how to use the Meta Pixel in a way that is as GDPR-compliant as possible.

For many privacy advocates, Meta is a red flag. It seems the Facebook parent company would rather pay fines than provide adequate protection for user data. In July 2023, Meta launched a new app: its latest venture is the Twitter clone "Threads." Potential users in Europe are still waiting for the app, though that is not (entirely) due to data protection concerns.

It is not just website and online shop operators who need to address data protection; app providers are also subject to the European Union's data privacy regulations. The GDPR imposes numerous obligations on business owners, including app operators, to protect the personal data of their users.

The CRM tool HubSpot is a valuable asset for companies in customer acquisition and sales. However, storing large amounts of personal data also raises data protection concerns. Read on to learn about the applicable regulations.

The EU General Data Protection Regulation (GDPR) fundamentally transformed data protection in 2018, imposing stricter obligations on companies that process and store personal data. In this article, we explain how the CJEU has interpreted the right of access to personal data and how you should handle these requests.

Aufmerksame Besitzer eines neuen Android-Gerätes haben es vielleicht schon entdeckt: die Suchmaschine Presearch als Alternative zu Google. Auch wenn die Bekanntheit und ihr Marktanteil noch sehr gering sind, ist das Auftauchen von Presearch auf dem Smartphone Grund genug, dass wir uns diese Suchmaschine hinsichtlich Datenschutz genauer anschauen.

Fingerprint devices are used in both private and professional settings, for example, to secure hardware. But what about data protection when it comes to these fingerprint scanners? And what other security concerns should be considered?

The electronic patient record, or ePA for short, is a divisive topic: will it give the German healthcare system a much-needed digital boost, or does it primarily pose a data privacy risk? We provide an overview of the digital patient record and data protection.

The exhibition halls stood empty for a long time, but the current situation has encouraged exhibitors and entrepreneurs to meet in person once again. When doing so, it is essential to keep trade fair data protection in mind during customer acquisition. We show you what to look out for and how to easily implement these requirements.

Many employees are worried about being honest with their company doctor. What information are they actually allowed to share with your employer? We’ll clear things up.

Have you been selected to participate in the microcensus? Is participation mandatory, or can you opt out? You can find all the key facts on the subject here.

Data protection often ends where online contact forms begin. The principle of data minimization, in particular, is frequently nowhere to be found. For website operators, this can quickly become expensive, as it carries the risk of significant fines.

Many companies rely on one or even several data processors in their day-to-day operations. These processors should be audited regularly to ensure that an adequate level of data protection is maintained. We outline the key points that must be considered when auditing your data processors. 

Appointing a data protection officer is essential for any company. However, it is crucial to mitigate the risk of a conflict of interest when making this decision. Read on to find out what you need to consider.

Does the right to be forgotten apply to Google? There have been various rulings regarding the right to have search queries removed from Google, ranging from the dismissal of cases to the imposition of fines.

To conclude a rental agreement, it is necessary to collect personal data. There are several important points for both tenants and landlords to consider. We have outlined the key rights and obligations regarding data protection.

Data processing abroad is a critical issue. What must be considered when company employees process or access personal data while visiting insecure third countries?

Every company collects data that is subject to GDPR regulations. We explain when a personal data breach occurs and the obligations that arise from such an incident. Furthermore, we show you how to minimize potential legal consequences.

Regular driver's license checks by the employer: While this is standard practice for companies with large vehicle fleets, it is worth taking a closer look at the legal foundations. In the following article, we summarize the basis for these checks and what you need to know from a data protection perspective when creating the corresponding records.

"Klingelgate." A welcome nuisance. Another reason to rail against the GDPR. So, the General Data Protection Regulation is now stripping citizens of their nameplates—or is it? No, because nameplates don't actually fall under the GDPR, but it certainly made for some great outrage. Aunt Erna will be pleased.

Telegram has long been considered a secure alternative to WhatsApp and similar apps because it does not require a phone number. However, this enthusiasm waned as more radical groups began using the platform for bot services and planning criminal activities. Criticism regarding data privacy has also grown louder; learn more about Telegram's data privacy practices here.

How are data managed after a person's death? This is known as post-mortem data protection. Find out here what steps need to be taken to manage the data of a deceased person.

As of January 1, 2022, electronic prescriptions are mandatory in all medical practices. However, e-prescriptions have also raised concerns regarding the sensitive data stored within them. Read on to learn how e-prescriptions align with data protection standards.

Medical appointment booking portals promise users a simple and straightforward way to schedule and manage doctor visits. Recently, the booking platform Doctolib has come under scrutiny by the Berlin Commissioner for Data Protection. This raises the question: is sensitive data being adequately protected, and what should we as consumers keep in mind when booking appointments online?

Video surveillance in the workplace is a hotly debated topic that concerns both employers and employees—and occasionally even ends up in court. What is the legal situation here? And why is camera surveillance in the workplace problematic under data protection law?

Online networks like LinkedIn make it easier to build and maintain professional connections. However, the information users are required to provide is usually personal data and should be protected accordingly.

Data protection and staff scheduling can be a tricky combination: as a general rule, duty rosters containing full names may no longer be posted in the workplace. However, there are simple ways to ensure that schedules remain accessible to all employees.

Pre-employment screening is an attractive method for companies to make the applicant vetting process more effective. As an HR professional, you should be aware of the data protection regulations in place to ensure you remain on the safe side legally. Our tips are here to help you navigate this.

Third-party cookies, which are set when visiting almost any website, are set to be phased out. This poses a problem for many advertisers, as cookie-based tracking is a massive market. So, what is the alternative? And is it more compliant with data protection regulations?

Smooth operations and a positive work environment are the foundation of a successful business. Employee surveys can provide valuable insights into these areas. Here is what employers should know.

It’s not just during the pre-Christmas rush that online shopping surges. However, shopping online can become problematic if consumers end up on shady websites. Here is what you should look out for when shopping online and how to spot dangerous fake shops.

The newsletter management provider Mailchimp is used by startups and large corporations alike. However, because the practical tool is operated by a US company, ensuring GDPR compliance can be challenging for businesses.

Due to the COVID-19 pandemic, the video conferencing tool Zoom gained more than 150 million new users almost overnight. Internet trolls looking to exploit the situation were quick to act, leading to the rise of what is known as "Zoombombing."

Videos are one of the most important means of communication today, and YouTube is one of the largest video platforms in existence. But how does YouTube handle data privacy and GDPR compliance?

Determining the data protection status of freelancers can often be tricky. We will show you how to clarify exactly what data protection requirements apply to "your" freelancers.

Since the GDPR came into effect, there has been widespread uncertainty regarding data protection. Some individuals are exploiting this to engage in scams and fraud under the guise of GDPR compliance. However, with a little background knowledge, it is not difficult to spot fraudulent data protection schemes.

Is Signal a secure messenger? As an alternative to the market leader WhatsApp, Signal is becoming increasingly popular. But how does Signal stack up when it comes to data privacy, GDPR, and related issues?

When many team members work remotely, scheduling via a polling tool is often the easiest approach. Here is what you should definitely keep in mind when using these tools within your company.

What will I look like when I’m old? Should I get preventative fillers for any potential wrinkles? To answer these questions, FaceApp helps with digital aging. However, what the app does with the data provided and the state of FaceApp’s data privacy is alarming.

Is the GDPR the modern-day Christmas Grinch? Not at all, because sending Christmas cards and other holiday greetings is still perfectly fine. Most of the time, anyway.

To ensure that data protection remains a priority during digital work—even in times of COVID-19 and widespread remote work—we have compiled the best data privacy tips for screensharing.

Credit agencies are privately organized companies that collect information on the creditworthiness, solvency, and economic activities of individuals and businesses. This information is stored and shared upon request with other companies looking to assess potential financial risks in business transactions.