Data protection law

Under current law, a data protection officer must be appointed if, as a general rule, at least twenty people are regularly engaged in the automated processing of personal data (Section 38(1) of the Federal Data Protection Act [BDSG]), regardless of whether the additional cases specified in Article 37 of the GDPR apply—such as in cases involving extensive processing of special categories of data. The Federal Government has announced that it will eliminate the twenty-person threshold by the end of 2026; until a relevant provision is published in the Federal Law Gazette, the current requirement remains in effect.

Depending on the nature of the violation, fines can range up to ten or twenty million euros; for companies, they can amount to up to two or four percent of global annual revenue, pursuant to Article 83 of the GDPR. The type, severity, and duration of the violation, as well as the extent to which the company cooperates in the investigation, are decisive factors. In addition, there may be claims for damages by data subjects and, depending on the circumstances of the case, consequences under competition law.

Within one month of receiving the request, Art. 12(3) of the GDPR. In the case of complex requests, this period may be extended by an additional two months; however, you must notify the data subject of this extension within the first month. In addition to the data itself, the information provided also includes the purposes, recipients, and retention period, which is why it’s worth having a prepared template.

Within 72 hours of the incident becoming known to the competent supervisory authority, unless a risk to the data subjects is unlikely, Art. 33 GDPR. If there is a high risk, the data subjects themselves must also be notified, Art. 34 GDPR. The deadline begins at the time you become sufficiently aware of the incident in concrete terms; therefore, the internal reporting chain should be established in advance.

Yes, Article 82 of the GDPR provides for compensation for material and non-material damages. According to the case law of the European Court of Justice, there is no materiality threshold; however, the data subject must demonstrate specific harm—the mere occurrence of a violation is not sufficient. Consequently, the amounts awarded vary accordingly.

Whenever a service provider processes personal data on your behalf and in accordance with your instructions, Art. 28 GDPR. In addition to hosting and cloud storage, this also applies to newsletter distribution, analytics tools, and external payroll accounting. The absence of a contract constitutes a separate violation in and of itself, regardless of whether anything actually happened to the data.