Data protection law

Data protection in the company

A key requirement of the GDPR is accountability, i.e. being able to prove that all data - online and offline - is processed lawfully and with the possible security measures. In this context, the GDPR provides for various documentation obligations.

We draft and update all necessary documentation customised for our clients. In addition to the processing directory in accordance with Art. 30 GDPR, this also includes the documentation of technical and organisational measures (Art. 32 GDPR) as well as data protection information in accordance with Art. 12 et seq. GDPR.

In addition, we support our clients in the implementation of new processes; this begins with the selection and examination of suitable means, such as software, and - where necessary - provides support through an early data protection impact assessment in accordance with Art. 35 GDPR.

Declarations of consent

The processing of personal data always requires a legal basis; this is often the consent of the data subject. We draw up individual declarations of consent for our clients for use both online and offline. This includes, for example, the design of "cookie banners" on websites or for an advertising approach following participation in competitions.

Rights of data subjects

In addition to the existing information obligations, data subjects have a right of access and objection, a right to rectification, a right to erasure of their data and restriction of processing as well as a right to data portability. We support our clients in safeguarding and implementing the rights of data subjects and advise, for example, on the necessary scope of a request for information in connection with an existing or terminated employment relationship, whereby we can apply our expertise in the field of data protection law and labour law in equal measure.

Third country transfer

If personal data is transferred to a country outside the EU or the EEA, the principles of Art. 44 et seq. GDPR must be taken into account. The requirements for the lawfulness of a transfer to a third country are regularly specified and reviewed by decisions of the supervisory authorities and courts. We support our clients in the agreement of corresponding contracts, inform them about current changes and support them in the respective implementation.

Employee data protection

As the interface between our labour law and data protection advice, we answer all questions relating to employee data protection. This includes, in particular, the organisation of employee training courses, the processing of personal data as part of the application process or the data protection requirements for home office and mobile working by means of work instructions under data protection law.

Communication with supervisory authorities

We are not only available to our clients for the entire compliance process, but also coordinate communication with supervisory authorities and provide representation and advice during inspections and proceedings by supervisory authorities and in court.

Data protection for transactions

Data protection also plays an essential role in the context of corporate transactions. As early as the due diligence stage, the potential acquirer must be able to access documents containing personal data in compliance with data protection regulations; virtual data rooms in particular encourage the rapid uploading of a large number of documents. We advise our clients on the data protection-compliant transfer of personal data in the context of asset deals and share deals.