The relevance of specific data protection and data security issues and requirements depends on size of enterprise and European or international orientation.
We support domestic and international clients – within and outside of the EU – from various sites: in the US, Europe, Germany – North and Germany – South.
Our clients value our single-source solutions. In-depth knowledge of IT is combined with end-to-end legal expertise. Focusing on the areas of data privacy and protection, IT security and information security, we support clients throughout Europe and act as a “bridge” to Europe for US enterprises.
Previously: Appointment of a data protection officer was normally obligatory for any company with 10 or more employees.
Appointment of a data protection officer is still mandatory for companies with 10 or more employees. However, in cases where processing makes impact assessment necessary, it may also be required for companies with fewer than 10 employees.
Previously: The previous practice was very frequently restricted to compiling documents and descriptions that had to be presented on the request of customers, suppliers, etc. (systemic approach).
Checks will be made to ensure that documentation, structures and day-to-day operations align with one another.
Previously: The data protection officer had to influence the organization and those in charge to implement the measures defined. Liability for data protection infringements and their effects on the company applied only in cases of gross negligence.
The management board must monitor the Data Protection Officer and provide proof of having done so.
Previously: The maximum fine was € 300,000, but was rarely imposed and only in particularly serious cases.
Penalties may be up to € 20 million or 4 % of global annual revenue as follows, depending on which amount is higher:
On May 25, 2016, the EU General Data Protection Regulation (EU GDPR) entered into force. Its goal is to create a harmonized EU framework to supersede existing national laws in Member States of the European Union. The regulation commenced with a two-year transitional period for its adoption into national law.
The Federal Republic of Germany has used opening clauses and passed a new Federal Data Protection Act that takes effect on May 25, 2018. The data protection rules laid down in the regulation apply to all companies with a registered seat in the EU.
