DATA PROTECTION IS A PART OF SOCIETY

As strong companions, our Data Protection Officers assist your management on different stages, starting from the audit through data erasure to the preparation of necessary expert opinions.

Sample Documentation Your companion

EXTERNAL DATA PROTECTION OFFICER

The German Association for Data Protection (from Petershausen near Munich) has set itself the task of advising companies in all aspects of data protection and providing external data protection officers. We develop concepts to implement the data security and protection of personal data in medium-sized companies and corporations.

The consulting Services of the German Association for Data Protection are rounded off by the possibility of the secure Data Erasure of Data Carriers and the physical Data Medium Destruction.

OUR SERVICES

External Data Protection Officer

Our data protection officers have expertise in IT and law and keep themselves updated on the latest standards in the field.

CONTINUE

Data Protection Audits

In order for our clients to be in compliance with legal requirements, we are screening the data processing procedures.

CONTINUE

IT Forensics Expert Opinions

We try to restore erased data and contribute to the investigation of criminal offenses by means of forensic analysis.

CONTINUE

Revision-Proof Data Erasure

We erase your data carriers in a revision-proof manner and use recognized erasure standards.

CONTINUE

IT Expert Opinions

An expert takes over the objective determination of facts for courts or in the private sector.

CONTINUE

License Audit and Software License Reports

We evaluate over and under licensing and accompany manufacturer’s audits.

CONTINUE
WITH EXPERTISE NEAR MUNICH

Our expertise in the fields of the German and European data protection law allows us to support companies from different industries as external data protection officers. Our employees help you to implement the requirements of the data protection regulations and the Charta of Fundamental Rights.

IN CONFORMITY

We help our clients to ensure compliance with data protection regulations and the supranational requirements of the European Union. We believe that data protection is to be considered a specific part of the quality management.

Compliance with data protection requirements creates trust. Data security is observed, in particular, by one’s own employees. Companies may clearly distinguish themselves from competitors by actively adhering to data protection.

Find out more

DATA PROTECTION CLOUD SOLUTIONS

The German Association for Data Protection has developed several cloud solutions for an economic and efficient implementation of the General Data Protection Regulation (GDPR). User friendly, legally compliant and efficient.

Our DGD Material

Here you can find our informative flyers, illustrating our work as external data protection officers as well as data protection auditors and our data protection cloud solutions.

Download Section

THE DATA PROTECTION MANUAL

For our clients we elaborate an individual data protection documentation. This data protection manual covers various legal requirements and concepts, which we adjust to your organization. Our individual consultation and a just-in-time realization and implementation of the GDPR represent a well aligned process.

Documentation is everything!

Here you can find and look into the first page of each chapter in our bilingual data protection manual.

To the insight

External Data Protection Officer

According to Art. 37 GDPR, both controller and processor may be required by law to designate a data protection officer. Under Art. 37 (1) lit. a-c GDPR, the appointment obligation exists in any case where a public body is involved in the processing (except for courts acting within the limits of their judicial capacity) or the focus of the operation of the controller or the processor lies on activities that involve extensive regular and systematic monitoring of data subjects, taking into account nature, extent and/or purpose of the processing. Furthermore, the obligation exists, if large scales of special categories of data within the meaning of Art. 9 GDPR or data relating to criminal convictions and offences (Art. 10 GDPR) are processed.

The new German regulation on the DPO goes beyond the above, whereby the particularly high level of data protection in Germany is to be maintained: in the case of automated data processing in accordance with § 38 (1) sentence 1 FDPR-NV, the obligation to appoint the DPO arises already, if at least ten people are regularly occupied with the processing of personal data. In practice this limit is quickly exceeded, which is why it is advisable to make early considerations about finding a suitable person.

Irrespective of the number of employees, the controller is subject to designation, as far as automated processing is concerned, which is subject to a data protection impact assessment, or personal data processed commercially for the purpose of transmission, anonymized transmission or for the purpose of market or opinion research (§ 38 (1) sentence 2 FDPA-NV). However, even without appointing a DPO it must be insured that all data protection regulations are adhered to.

Art. 37 (6) GDPR stipulates that instead of an internal employee of the company an external data protection officer may be appointed. In any case, a DPO shall be designated in accordance with Art. 37 (5) GDPR on the basis of his professional qualities, his data protection expertise and his personal experience in data protection practice. Furthermore, he must be able to fulfill the obligations set out in Art. 39 GDPR. These prerequisites may basically be fulfilled by both a well-trained internal employee and an external person. However, there are differences between the two groups: while an internal DPO usually already has a good understanding of operational processes, which may be useful for the cooperation with the employees and possibly a works council, the external data protection officer often specializes in data protection law, keeps himself up-to-date about the latest developments and distances himself from the company to the certain extent, which is why he can perform his duties objectively.

If the data protection officer is not appointed contrary to the existing legal obligation, it may, according to Art. 83 (4) lit. a GDPR, result in a fine of up to € 10,000,000 or 2% of the worldwide annual turnover, whereby the choice of the alternative depends on whichever amount is higher.