Data Protection Consulting

Data protection consulting, precise and hands-on.

Practical GDPR consulting for every part of your business.

What we deliver

From obligation to advantage.

We advise on records of processing activities, processing on behalf, data protection impact assessments and data subject rights, by phone, email or on site.

  • Records of processing activities (Art. 30 GDPR)
  • Reviewing and drafting data processing agreements
  • Data protection impact assessments
  • Handling data subject requests
  • Legal defence against warning notices and access requests

How we work

Three steps to your goal.

  1. Step 01

    Initial briefing

    You describe the specific occasion: a supervisory inquiry, a planned processing activity, a data breach. We listen and prioritise.

  2. Step 02

    Review & advice

    We assess the facts and the legal situation against GDPR and BDSG and provide a written opinion with a recommended course of action, typically within 5 working days.

  3. Step 03

    Implementation

    On request we support implementation: contract adjustments, employee training, communication with authorities.

GDPR in practice

Data protection, whenever you need it.

The GDPR touches every process that handles personal data, from job applications and newsletters to cloud services. Good advice replaces template compliance with decisions that fit your real-world data flows. Companies in Frankfurt am Main, the Rhine-Main region and across Germany we also advise on site on request.

When advice pays off most

  • An enquiry or audit by the supervisory authority
  • A new processing activity, new tool or website relaunch
  • Access, erasure or compensation requests from data subjects
  • Rolling out AI systems or extensive tracking
  • Unclear legal basis or third-country transfer (e.g. US services)

The obligations that really matter

  • A legal basis for every processing activity (Art. 6 GDPR)
  • Records of processing activities (Art. 30 GDPR)
  • Data processing agreements with your providers (Art. 28 GDPR)
  • Data subject rights handled on time (Art. 12 to 22 GDPR)
  • Technical and organisational measures (Art. 32 GDPR) and, where needed, a data protection impact assessment (Art. 35 GDPR)

Advice, not boilerplate

We assess the facts and the law against the GDPR and the German BDSG and deliver a written opinion with a prioritised action plan, in plain language and, on request, supported all the way into implementation. That turns data protection from a brake into a solid foundation.

More services

What else we cover.

From the blog

Further reading on the topic.

Need advice on data protection?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What clients ask before the first conversation.

In which areas does a company need GDPR advice?
Wherever personal data is processed. Under Art. 4(1) GDPR, personal data is any information relating to an identified or identifiable natural person: name, address, email, IP address, customer number or location data. Processing under Art. 4(2) GDPR is any operation on such data, from collection and storage through retrieval and use to transmission and erasure. In practice that covers every project in which data arises: websites, apps, software, online shops, recruitment, newsletters, cloud services and the use of AI tools.
Do you also prepare data protection impact assessments (DPIA)?
Yes. We prepare DPIAs under Art. 35 GDPR with threshold analysis, risk assessment and concrete safeguards, coordinated with supervisory authorities where needed.
How is one-off advice billed?
By effort, in quarter-hour units at a rate of €200 net per hour, with no base fee. Before we start you receive an estimate of the expected time.
Do you also handle access requests under Art. 15 GDPR?
Yes. We assess the scope of the access request, compile the relevant data and draft the reply within the one-month deadline under Art. 12(3) GDPR.
What fines and penalties are possible?
Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.