Data Protection Management System (DSMS)

Data Protection Management System, always current, always at hand.

Your GDPR documentation centralised, current and always audit-ready.

What we deliver

From obligation to advantage.

We provide our cloud-based data protection management system for records of processing, deletion concepts, TOMs, processors and data subject requests in one place, with or without accompanying consulting.

  • Records of processing activities maintained centrally (Art. 30 GDPR)
  • Deadline and follow-up management for deletions and audits
  • Templates for DPAs, consents and data subject requests
  • Documentation of TOMs and processors in one place
  • Roles and permissions for multiple users in your company

How we work

Three steps to your goal.

  1. Step 01

    Setup

    We set up your DSMS and transfer existing documentation, records of processing, DPAs, TOMs, into the platform.

  2. Step 02

    Training & handover

    Your staff receive access and an introduction, optionally with a roles-and-permissions concept per department.

  3. Step 03

    Ongoing maintenance

    On request we take over ongoing maintenance and updates, or you maintain the system yourself with our support in the background.

Documentation with a system

Accountability: solved digitally.

The GDPR requires not only that you comply with data protection but that you can demonstrate it (accountability, Art. 5(2) GDPR). A data protection management system (DSMS) bundles all the necessary evidence in one place instead of scattering it across folders, inboxes and spreadsheets. Setup runs remotely; for the rollout and training we are on site with clients in Frankfurt am Main, across the Rhine-Main region and throughout Germany, or we deliver the training remotely.

What a DSMS brings together

  • Records of processing activities (Art. 30 GDPR)
  • Data processing agreements and sub-processor lists
  • Technical and organisational measures (Art. 32 GDPR)
  • Deletion concept with deadlines and follow-ups
  • Data subject requests and consent records

Why central beats scattered

Deadline and follow-up management ensures deletions and audits are not forgotten. When the authority asks, you produce the evidence at the push of a button instead of hunting for records.

Accountability as liability protection

In a dispute or an audit, what you can prove is what counts. A well-maintained DSMS makes compliance visible and is a key building block for reducing fines and liability risk.

More services

What else we cover.

From the blog

Further reading on the topic.

Need advice on data protection?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What clients ask about a data protection management system.

What is a data protection management system (DSMS)?
A DSMS is the structured place where all the evidence the GDPR requires is kept and kept current: the record of processing activities (Art. 30 GDPR), the data processing agreements (Art. 28 GDPR), the technical and organisational measures (Art. 32 GDPR), the erasure concept, the data protection impact assessments (Art. 35 GDPR), the training records and the handling of data subject requests. The advantage over folders and spreadsheets: everything sits in one place, changes are traceable with date and author, deadlines and follow-ups do not pass unnoticed, and in an audit by the supervisory authority you meet the accountability duty under Art. 5(2) GDPR with an export instead of a search party.
Is the DSMS hosted in a GDPR-compliant way?
Yes, hosting takes place exclusively on servers in the EU, with no third-country transfer.
How long does setting up the DSMS take?
Usually 1 to 3 weeks depending on data volume and existing documentation, from transferring existing records to a fully configured system including a roles-and-permissions concept.
Does the DSMS also support handling data subject requests?
Yes. Templates for access, deletion and rectification requests, plus deadline tracking under Art. 12(3) GDPR, are built into the system so the one-month deadline is never missed.
What fines and penalties are possible?
Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.