Data protection and IT security

Data protection and IT security are interlocking, but have different protections and legal requirements. Companies need clear responsibilities, resilient service contracts and procedures for security incidents. We advise on the legal requirements and, if necessary, coordinate their implementation with the responsible data protection and IT specialists.

Typical counseling events

• A company introduces cloud services, AI applications or new personnel software.
• Service providers receive access to customer, employee or company data.
• A phishing mail, a lost device or an attack may result in data outflow or failure.
• A customer requires proof of information security or special contractual commitments.
• The concern of the BSI Act or the NIS-2 implementation must be clarified.

Organize data protection in the company

Among other things, the GDPR requires lawful, transparent and purpose-bound processing of personal data. For typical processing operations, the legal basis, scope of data, recipients, storage periods and responsibilities must be established. Consent is not required for any processing and especially in the employment relationship cannot be used as a standard solution.

Information obligations, information and deletion processes, lists of processing activities and, where appropriate, the appointment of a data protection officer shall be examined on the basis of the respective conditions. In the event of a likely high risk, a data protection impact assessment under Art. 35 GDPR may be required. It is not a general mandatory document for any software.

Service providers and international data flows

The contractual role of a service provider depends on the actual processing. An order processing agreement pursuant to Art. 28 GDPR does not automatically match any cooperation. Joint or independent responsibility may require a different arrangement.

In the case of cloud and AI services, particular uses, subcontractors, access options, deletion, security measures and possible use of input for training purposes are to be checked. Transfers to third countries also require a basis in accordance with Chapter V of the GDPR and, where appropriate, further measures. A location advertised as European does not answer every question about accesses from other states.

IT security and NIS-2

Art. 32 GDPR requires risk-sensitive technical and organizational measures for personal data. This may include, for example, authorisation concepts, appropriate authentication, backup copies, recovery procedures and regular review of the measures. The concrete technical design is determined on the basis of the systems and risks.

Since 6 December 2025, the provisions of the NIS-2 Implementation Act have been in force in Germany. Whether a company is included as an important or particularly important institution in accordance with § 28 BSIG depends, among other things, on activity, size and legal special regulations. There is no flat-rate NIS-2 requirement for each company. In particular, risk management, registration, reporting and management obligations may apply to the entities covered. Special sectoral rules shall be taken into account in addition.

Safety incidents: several tests in parallel

In the event of an incident, technical containment, evidence protection and legal evaluation should be coordinated. A central event overview shows what was known when, which data and systems were affected and what measures were taken. Reporting obligations must not be examined after full information.

• GDPR: In principle, a breach of the protection of personal data shall be reported to the competent supervisory authority without undue delay and as far as possible within 72 hours after notification, unless it does not likely lead to a risk to the rights and freedoms of natural persons. The evaluation shall be documented.
• Persons concerned: In the event of a likely high risk, Art. 34 GDPR including its exceptions must also be examined.
• Processors: You must inform the controller immediately in the event of a data breach; the 72-hour period is not a general waiting period for service providers.
• BSIG: For significant security incidents of detected facilities, § 32 provides for an early notification within 24 hours, a further notification within 72 hours and a final report no later than one month after the 72-hour notification. In the event of continuing incidents and in special cases, supplementary rules shall apply.

An IT failure is not automatically a reportable data breach. Conversely, a data breach may occur even though the systems continue to function. Both tests must be properly separated and coordinated.

Our services and work results

• Legal stocktaking and prioritized action plan.
• Examination of service provider, cloud and order processing contracts.
• Design of data protection information, responsibilities and deletion processes.
• Examination of the NIS-2 concern and legal monitoring of organisational implementation.
• Reporting and escalation concept for security incidents as well as legal support in the specific case.
• Training and case exercises for management, personnel, IT and other affected areas.

Common questions

Does an external IT service provider automatically make us legally compliant?

Nope. Tasks can be supported or outsourced; own responsibilities remain to be checked. Contract, actual performance, control and communication in the incident must fit together.

Do we have to report any attack within 72 hours?

Not every attack meets a reporting record. The concrete concern and the requirements of the respective law are decisive. In the event of uncertainty, the assessment should start early and be documented in a comprehensible manner.

Is a privacy statement sufficient on the website?

Nope. It only concerns a cut-out. Internal processing, employee data, service providers, data subjects' rights and security measures require their own processes.

Which documents facilitate entry?

A system and service provider overview, existing data protection documents, contracts and jurisdictional plans. In the event of an incident, a chronology, initial technical information and communications that have already been made are particularly helpful.

Legal basis and further official information

• GDPR, in particular Articles 5, 6, 28 and 32–35
• § 26 BDSG – Employee data
• BSI – Information on NIS-2
• § 28 BSIG – recorded institutions
• § 32 BSIG – Incidental reports
• § 33 BSIG – Registration

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Related topics and next steps

• AI compliance
• Internal investigations
• Whistleblower protection and internal reporting channels
• Training and workshops

Request advice on the contact page. Briefly describe your request and, if necessary, specify existing deadlines. Scope and remuneration will be agreed prior to commissioning.