Blog
Our blog. Worth reading on data protection.
Rulings, practical tips and background on the GDPR and data protection in the company, compiled concisely by our team.
-
Data Protection Officer: when is one required? 2026 From 20 people, or from one for certain processing: when a Data Protection Officer is required today, how people are counted and what failing to appoint one costs. Read more → -
AI labelling: Art. 50 EU AI Act Art. 50 of the EU AI Act applies from 2 August 2026. Who has to disclose what, and which cases companies are actually affected by. Read more → -
Encrypting email invoices: liability risks A recent ruling shows that sending invoices unencrypted by email risks liability. Which security measures are now mandatory. Read more → -
Copyright on sandals: the BGH ruling The German Federal Court of Justice Birkenstock decision on copyright protection for design, and what it means for product design. Read more → -
Google reviews: BGH VI ZR 34/15 When a bad review can be removed, what review portals must examine under BGH case law, and how the DSA notice procedure works. Read more → -
When may personal data be stored? (outdated, as of August 2023) Definitions and legal bases for storing personal data under the GDPR and BDSG, explained clearly. Read more → -
Data protection for SMEs: an overview Which requirements workplace data protection places on SMEs, and how to keep the effort manageable. Read more → -
Data traces: your rights under the GDPR Why an IP address is personal data, when tracking requires consent, and which rights get your data traces removed again. Read more → -
Top 5 data protection violations in companies The most common data protection breaches and their cost consequences, with concrete tips on avoiding them. Read more → -
Google Analytics: consent under § 25 TDDDG Why web analytics requires consent under § 25 TDDDG, what the 2023 adequacy decision changed for US transfers, and which duties remain. Read more → -
Data breach: 72 hours, Art. 33 GDPR The 72-hour deadline under Art. 33 GDPR starts on becoming aware. When you must notify, what the notification must contain and which fine tier actually applies. Read more → -
Removing or dismissing the Data Protection Officer Legal bases and procedures for removing or dismissing a company Data Protection Officer. Read more →
The full articles are available in German.
Archive
All earlier articles116
The complete set since 2019. Older articles reflect the legal situation at the time; every entry carries its date.
2023 1 article
2022 22 articles
- ISO 27001 certification for SaaS companies
- The works council’s data protection duty under § 79a BetrVG
- Passive social engineering: what employers can do
- Right of access: Art. 15 GDPR and the works council
- Protecting data with a VPN: how it works
- Who needs a Data Protection Officer? (outdated, as of August 2022)
- The information security officer in a company
- Data protection impact assessment: what to know
- Driving licence checks by the employer: allowed?
- Internal Data Protection Officer: pros and cons
- Why data protection training for staff pays off
- When is processing personal data permitted?
- Cookie banners: Belgian authority rules the TCF unlawful
- Staff retention: are you an attractive employer?
- Google Fonts: damages under Art. 82 GDPR (outdated, as of February 2022)
- Working while on sick leave: who is liable?
- Statistical analysis of employee data
- Unlawful questions in a job interview
- Employee surveys: what companies must know
- Monitoring PCs at work: what employers may do
- May the employer copy the vaccination record? (outdated, as of January 2022)
- May employers record telephone calls?
2021 22 articles
- GDPR data subject rights: what companies face
- The 3G rule in the office: what employers must know (outdated, as of December 2021)
- Video surveillance of staff: what employers may do
- Which employee data may the employer publish?
- Returning from holiday: what employers must know (outdated, as of November 2021)
- White hat hackers: how cyberattacks help data protection
- Publishing a birthday list in the company?
- Whistleblowing directive: what applies to employers (outdated, as of October 2021)
- Employee health data: what employers must observe
- Business data: how secure is transfer over the internet?
- Deletion of personal data after a dismissal
- Time recording versus data protection
- Data protection when working from home
- Asking for vaccination status: mistakes to avoid (outdated, as of September 2021)
- Federal Labour Court on Art. 15(3) GDPR: scope of the data copy
- Video surveillance in online exams is lawful
- Art. 66 GDPR: urgency procedure against Facebook
- Register Modernisation Act: milestone or risk?
- Constitutional Court on referrals under Art. 267 TFEU
- Draft law implementing the EU copyright directives
- (Almost) the first million-euro GDPR fine
- Informational self-determination
2020 37 articles
- Security through and despite encryption
- Digitalisation and the world of work: crowdworking
- Fifty years of the Hessian Data Protection Act
- Inheritance law and digitalisation
- The system of data subject rights: VG Regensburg
- Florian Kaiser on rheinmaintv about the Corona warning app (outdated, as of August 2020)
- Interview: does the Corona app breach privacy? (outdated, as of August 2020)
- Online surveys: the consent of minors
- The EU-US Privacy Shield is invalid (outdated, as of August 2020)
- A real-name requirement online? A balancing act
- Checking employees’ email: what is allowed?
- Publishing staff photos online: how it works
- Tracking in retail: the transparent customer offline
- Data protection in schools and kindergartens
- The Corona warning app has been released (outdated, as of June 2020)
- Private internet use at work
- New employees: keeping data protection intact
- Corona and data protection part 5: contact details everywhere (outdated, as of May 2020)
- Can Facebook and data protection be reconciled? (outdated, as of May 2020)
- Corona and data protection part 4: tracking apps (outdated, as of May 2020)
- Data protection at work: what employers may do
- Corona and data protection part 3: what are tracking apps? (outdated, as of April 2020)
- The like button: embedding Facebook correctly
- Corona and data protection part 2: information on apps (outdated, as of April 2020)
- Authorities step up checks for data protection breaches
- Corona and data protection part 1: what employers must know (outdated, as of April 2020)
- Personal data: the categories that exist
- Is there a right to be forgotten?
- The ePrivacy Regulation: what it means for companies (outdated, as of March 2020)
- Fines for data protection breaches have risen
- Data protection in 2020: what companies should expect (outdated, as of February 2020)
- Destroying files in line with data protection law
- How self-driving cars affect data protection
- Will Brexit affect data protection? (outdated, as of January 2020)
- Smart watches and fitness apps: wearable data spies?
- TikTok, censorship and the risk to data security
- Data protection in prize competitions
2019 34 articles
- The record of processing activities
- Shredding data: how files are really deleted
- What the Federal Data Protection Act contains, part 2
- What the Federal Data Protection Act contains, part 1 (outdated, as of December 2019)
- What is prior checking in data protection? (outdated, as of November 2019)
- Tasks of an information security officer
- Data protection and information security compared
- The tasks and functions of a Data Protection Officer
- Right of withdrawal: how to revoke data processing
- Email data protection: guarding against trojans
- Legitimate interest in processing: what it means
- What the new CJEU cookie ruling means (outdated, as of October 2019)
- The ePrivacy Regulation: what to observe and when it arrives (outdated, as of October 2019)
- The double opt-in procedure explained
- The GDPR in practice: a first assessment
- These are consumers’ rights under the GDPR
- Patient protection: passing on medical records
- WhatsApp alternatives for companies
- DPIA: the data protection impact assessment explained
- Personalised marketing and the GDPR
- Cloud security: personal data in the cloud (outdated, as of August 2019)
- Data protection breaches: six mistakes to avoid
- The GDPR and social media marketing (outdated, as of August 2019)
- How to send newsletters under the GDPR
- Imprint obligation: what to watch out for (outdated, as of June 2019)
- Privacy policy: tips with the GDPR in mind
- Principles of the GDPR: all the basics
- Data processing agreement: when is it required?
- Analytics, tracking and cookies: what to watch (outdated, as of June 2019)
- Data Protection Officer: from when is one required? (outdated, as of June 2019)
- Privacy policy for social media channels
- The advantages of an external Data Protection Officer
- GDPR warning letters: competitors can act on breaches
- Data protection for online shops: what to watch
Knowledge that lasts
Data protection, clearly explained.
Our blog translates current developments in data protection and IT law into practical guidance, clear for decision-makers, solid for specialists.
What we write about
- Recent court rulings and what they mean in practice
- The GDPR in the everyday life of small and medium-sized companies
- AI law (EU AI Act) and NIS-2
- Websites, cookies and tracking
- Data breaches and how to handle them
Who the blog is for
For management, Data Protection Officers and those responsible in marketing and IT who want to know quickly what a development concretely means for their company.
Currency and verifiable sources
We keep the current articles up to date with the 2026 legal situation and rely on verifiable sources from authorities, courts and professional organisations. The archive goes back to 2019 and reflects the legal situation at each publication date.