Services

External data protection officer

In practice, every company, association or other body must appoint a data protection officer if, as a rule, twenty or more persons are regularly engaged in the automated processing of personal data. Since computers are used at almost every workplace today, this threshold is reached quickly. Bodies that handle particularly sensitive data (e.g. health or patient data) must always appoint a data protection officer, regardless of the number of persons involved.

It is often overlooked that it does not matter whether data is processed from or for third parties – handling your own employees' data (for example in HR administration) is also processing of personal data.

We offer our clients an external data protection officer because, in our experience, an internal one quickly reaches their limits: they usually have to perform the role alongside their actual job, they lack practical experience in data protection, and colleagues find it easier to put off an internal data protection officer than an external one who simply sets clear deadlines. From the employer's point of view, the internal data protection officer must also be trained regularly, and once made, the appointment cannot be revoked without the appointee's consent because of the special protection against dismissal and removal.

Advice for internal data protection officers

Where an internal data protection officer has been appointed, we offer to support and advise them in their work. This makes processes more efficient, and the internal data protection officer benefits from our experience.

Training

We offer training for individual departments and/or the entire company. In addition to classic in-person sessions, we also offer online training, which is particularly suitable when a larger number of employees need to be trained. For sensitive areas – such as HR or the medical sector – we generally recommend in-person training, because it gives employees a direct opportunity to ask questions.

EU representative (Art. 27 GDPR)

The GDPR also applies to companies without an establishment in the EU if they offer goods or services to people in the Union – for example through an online shop or an app – or monitor their behaviour, for example through tracking. Under Art. 27 GDPR, such companies must designate a representative in the Union in writing. The only exception is processing that is occasional, does not involve sensitive data on a large scale and is unlikely to result in a risk to the data subjects.

The representative is the point of contact in the EU for supervisory authorities and data subjects and must also maintain the record of processing activities. We act as EU representative for companies from third countries, based in Berlin: we receive enquiries, forward them reliably and support you in responding to them. As we also work as data protection officers, we know from practice what German supervisory authorities expect.