General questions and answers
Here you will find answers to questions we are frequently asked. If your question is not covered, please feel free to contact us directly.
We specialise in IT law, compliance, whistleblower protection, data protection, and acting as external Data Protection Officers.
Yes, we provide advice across Germany.
Yes, we provide EU-wide advice through our co-founder Diane Frank Baeza.
In addition to German, we advise in English, French, Spanish, Italian, Turkish and Portuguese.
We advise clients ranging from single IT specialists to multinational corporations with legal and data protection departments – from 1 to 10,000 employees.
IT CONTRACT LAW
Legally compliant online marketing, online shops and websites, drafting and reviewing software contracts, legal questions around big data and AI, implementation of software projects, and works council agreements on IT and compliance.
We advise on how to design direct marketing campaigns based on profiling or data analysis in a legally compliant way. Can existing customer data be used for new profiles? We provide solutions and address data protection concerns in marketing strategies.
“Privacy made in Germany”: we support privacy by design and by default, help strengthen your IT services when dealing with your clients’ Data Protection Officers, draft outsourcing contracts for ERP or CRM projects, and assist with developing deletion concepts.
From private internet and email use at the workplace to drafting staff policies or works agreements: we help you implement clear and compliant employee data protection frameworks.
Data Protection
Under the GDPR, whenever processing activities create significant risks for data subjects.
From 20 employees, counted by headcount.
Persistent refusal may result in fines.
We advise and monitor GDPR compliance, train employees on data protection, support with data protection impact assessments, advise on data processing agreements, and maintain documentation in a data protection manual.
After you reach out, we schedule an initial consultation to assess your current status. Three days later, you receive a tailored proposal. If you accept, you become our client, receive the contractual documents, and we proceed with follow-up meetings.
Legal and organisational data protection tasks, feedback on contracts and wording, provision of template clauses, updates on legislative changes, and support during negotiations.
Absolutely – that is one of our core areas of expertise.
WHISTLEBLOWING & COMPLIANCE
Since 2 July 2023.
Companies with more than 50 employees must set up an internal whistleblowing system. For companies with fewer than 250 employees, there was a transition period until 17 December 2023.
We operate the whistleblowing system with personal availability and an online portal, acting as a neutral point of trust between whistleblowers and your company.
We are personally available to whistleblowers and have many years of experience in handling reports. In addition, we provide all reporting channels from a single source, including an online portal.
It reduces the burden on your internal infrastructure.
We have been active in this field since 2011. Processing reported cases requires legal expertise – for example, assessing credibility under Section 17 HinSchG or dealing with the specific offences listed in Section 2 HinSchG.
DATA ACT
The Data Act is part of the EU data strategy and regulates access to, use of and sharing of data generated by products and related services. It primarily affects manufacturers of IoT-enabled products and services, focusing on the data stored by the manufacturer. This means not only individuals will have greater control over their data, but businesses will also be able to share and analyse machine and industrial data.
Users of connected devices gain easier access to product and service data. Small and medium-sized enterprises also benefit, as abusive contractual clauses on data use will be prohibited.
Companies must make usage data easily and comprehensively available – in both B2C and B2B contexts – typically through secure, interoperable technical interfaces. Data may only be used within the contractually agreed framework. In addition, the Data Act eliminates unfair contractual terms regarding data use and access in B2B relations.
The Data Act governs fair access to and use of both personal and non-personal data. Where personal data is involved, the GDPR applies in parallel and takes precedence in case of conflict. The Digital Services Act (DSA) regulates online platforms such as social networks, while the Digital Markets Act (DMA) focuses on fair competition in digital markets, especially for large “gatekeeper” platforms.
In Germany, the Federal Network Agency will supervise non-personal data compliance, while the Federal Data Protection Commissioner (BfDI) oversees personal data. Breaches involving personal data may lead to fines of up to EUR 20 million or 4% of annual global turnover.
CYBER RESILIENCE ACT (CRA)
The CRA is an EU regulation that sets minimum cybersecurity requirements for products with digital elements. Its goal is to reduce vulnerabilities in connected hardware and software. It applies to manufacturers, distributors and importers placing such products on the EU market.
You must ensure that your products are secure, carry out risk assessments, report vulnerabilities and respond to security incidents. Extensive documentation and evidence obligations also apply.
- From 11 June 2026: notified bodies may begin CRA conformity assessments.
- From September 2026: mandatory reporting of security incidents and vulnerabilities takes effect.
- From 11 December 2027: all affected products must fully comply with the CRA requirements.
Non-compliance may result in fines, sales bans and claims for damages. Reputational damage is also a concern, and contractual partners will more easily enforce warranty rights.
The CRA increases liability for insecure products in the context of security incidents. Companies should act proactively to reduce liability risks from cyberattacks or security flaws.
Yes. The CRA requires companies to assess the cybersecurity of their supply chains and implement appropriate contractual safeguards. We can support you in making these adjustments.
We provide comprehensive advice on the CRA’s legal requirements. Together with our technology partner SEKAS GmbH, we review your products and processes, and support you in implementation. Our services include legal risk assessments, contract reviews, staff training, and assistance in communications with authorities and customers.
AI ACT
The AI Act entered into force in August 2024, with obligations applying in stages. It applies to both providers and users of AI systems in the EU. Its purpose is to ensure AI is safe, transparent and ethical – protecting users while fostering innovation.
The AI Act defines AI in a technology-neutral way: machine-based systems that operate with varying levels of autonomy, can adapt after deployment, and generate outputs such as predictions, recommendations or decisions that influence physical or virtual environments. The Act follows a risk-based approach. We can assess which risk category your system falls into as part of a legal review.
Depending on classification, compliance requirements increase – from transparency obligations to strict rules for high-risk systems. These include establishing a risk management system (Art. 9), undergoing conformity assessments, and maintaining extensive technical documentation (Art. 11).
High-risk AI includes systems used in vocational training, law enforcement, or in granting access to essential services such as healthcare or insurance.
The competent authority in Germany is the Federal Network Agency (BNetzA). Sanctions can reach up to EUR 35 million or 7% of annual global turnover. Reduced fines apply for SMEs and start-ups.
NIS-2 DIRECTIVE
The NIS-2 Directive is an EU law aimed at strengthening cybersecurity across key sectors. It requires companies to implement robust security measures, establish clear responsibilities and report incidents promptly.
This depends on your sector, company size and systemic relevance. We can carry out a comprehensive assessment to determine whether your organisation is covered by NIS-2.
Yes. Even businesses below the formal thresholds may be included if they perform critical functions. A tailored legal assessment is essential in these cases.
Non-compliance can result in substantial fines, regulatory measures and even personal liability for management.
We design tailored compliance programmes – from risk assessments to internal policies and reporting procedures. With our Compliance-as-a-Service model, we provide hands-on support and relieve the burden of day-to-day compliance.
NIS-2 is complex, involving not only technical but also liability and governance issues. As a law firm specialised in IT and data protection law, we ensure that your implementation is legally sound and economically viable.