External data protection and information security officer – with technical know-how
Many data protection officers know the GDPR by heart, but not your systems. The result: folders full of documents that have little to do with reality. We work differently. We build and run software ourselves, implement BSI IT-Grundschutz internally and are GDPR-native. We understand what happens inside your systems – and make data protection and information security effective where it counts.
Two roles, one goal – your data in safe hands.
External data protection officer
We take on the role under Art. 37 GDPR, advise you on all data protection questions, monitor compliance and act as the point of contact for data subjects and supervisory authorities.
External information security officer
We steer your information security management, assess risks and put measures based on BSI IT-Grundschutz, ISO 27001 or NIS2 into practice – pragmatically.
Data protection that works day to day.
Records & documentation
Records of processing activities, TOMs, deletion concept and data processing agreements – complete, up to date and easy to understand.
Technical review
We don't just look at paperwork, but at your systems, interfaces and service providers. That's where the real risks arise.
Risk analysis & DPIA
Data protection impact assessments and risk analyses that lead to concrete measures instead of ending up in a drawer.
Incidents & data breaches
When things go wrong, we're there. We assess incidents, coordinate notifications to the supervisory authority and help fix the root cause.
Training & awareness
Your team is your most important safeguard. Our training is practical – without legal hair-splitting.
Requests & data subject rights
Access requests, erasure requests and contact with authorities – we handle the communication and make sure your processes are sound.
From status quo to data protection in practice.
We start with an honest assessment and build on it step by step. Prioritised by risk, not by legal paragraphs.
Assessment
We get an overview of your processing activities, systems, service providers and existing documentation.
Risk assessment & prioritisation
We show clearly where the biggest risks lie and what should be tackled first – with realistic effort.
Implementation
We create the documentation you need and guide technical and organisational measures through to implementation.
Ongoing support
As your appointed officers, we are your permanent point of contact, review regularly and keep everything up to date when systems or laws change.
Enablement
We build up knowledge in your team. If you want to fill the role internally later on, we prepare the handover.
Honest answers.
In Germany, a data protection officer is generally mandatory as soon as at least 20 people are regularly involved in the automated processing of personal data – or regardless of headcount if you process particularly sensitive data. If you don't need one, we'll tell you.
Data protection and security that actually protect?
Together, we'll look at where you stand and what you really need. No obligation, honest and without scaremongering.