Data protection law: lawyers for GDPR compliance and privacy litigation
For companies that process personal data: we advise on GDPR compliance, support you in dealings with supervisory authorities and represent you in data protection lawsuits.
When data protection becomes business-critical, your company needs a line that works internally as well as externally
As a law firm for data protection law with Fachanwälte für IT-Recht (certified specialist lawyers for IT law), ITMR Rechtsanwälte advises companies, founders, start-ups, agencies, platform operators, investors and other professional market participants throughout Germany from Düsseldorf.
We support you when GDPR compliance needs to be built up robustly or proceedings need to be conducted properly. We also support you when a contentious situation needs to be brought under legal and commercial control.
Data protection in a company is not decided by a single document. What matters are the points at which processes, product, HR, sales, service providers, international data flows and responsibilities actually come together. That is where liability, deadlines and pressure to provide evidence arise. Often the question also arises whether a decision taken will stand up to the supervisory authority, data subjects, contractual partners or a court.
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)
Your contact: Dominik Skornia, LL.B.
Rechtsanwalt (lawyer) · Focus on data protection law and IT law · External data protection officer
What happens after your enquiry?
After your enquiry, we get back to you within 24 hours on working days. The first contact is free of charge. Before any costs arise, we tell you so explicitly.
- A short description is enough. Helpful are a short description of the occasion and any letters from the authority, data subjects or the other side. Please also name running deadlines and the systems or service providers involved.
- Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
- Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.
Your contact is Dominik Skornia and his team. He is a lawyer (Rechtsanwalt) focusing on data protection law and IT law and an external data protection officer.
- Several Fachanwälte für IT-Recht (certified specialist lawyers for IT law)
- Certified data protection qualifications
- Experience with authorities and disputes
- Advice for companies throughout Germany
- a data breach, a request for access, a letter from an authority or a claim for damages is already on the table,
- new tools, service providers, marketing or platform structures have been introduced without roles, contracts and documentation being properly updated,
- investors, enterprise customers, internal audit or management demand robust data protection evidence,
- data protection in the company is no longer just a formality but has become an issue of organisation, risk and decision-making.
- specific proceedings, damages or a fine are already in the foreground: Privacy litigation,
- an incident already needs to be dealt with technically and organisationally: Help with data breaches,
- the overarching management of digital obligations and audit readiness matter most: IT compliance & legal register,
- the core question is not data protection in the narrower sense but data access, interoperability or product data: Data law.
In brief
We advise companies throughout Germany when data protection becomes business-critical. This concerns building compliance, data breaches, proceedings before authorities, requests for access and damages.
When you need us
Data protection mandates in companies rarely begin in the abstract. Usually there is already a situation in which time, responsibility and commercial relevance coincide. This is when it becomes clear whether data protection exists only on paper or whether the organisation can actually support decisions.
When structure, responsibility and approval processes no longer fit together
In companies that have grown, the problem is often not the individual form. It is the interplay of responsibilities, approvals, chain of service providers, data flow and documentation. Data protection then becomes confusing because different departments work on different assumptions. Product thinks in features, marketing in campaigns, HR in processes, purchasing in contracts and IT in systems.
Such situations can rarely be settled by individual corrections. This is where a sound data protection set-up gains value. It brings order to roles, priorities and robust implementation instead of merely covering up symptoms.
When it is unclear how sound the current state really is
Many companies have privacy notices, contracts and records, but do not know for sure whether these documents still reflect the actual processes. Especially after growth, tool changes, mergers, new business models or international roll-outs, a gap often arises between document and reality.
In this situation, a precise data protection audit often makes more sense than merely revising texts. It translates legal bases, storage logic, service provider structures, international transfers and organisational weaknesses into a list of priorities that can be implemented.
When the website is only the visible tip of the problem
On websites, data protection issues become visible particularly quickly. However, the real difficulty often lies behind them. Consent management, third-party tools, form flows, retargeting, analytics tools, embedded content, newsletter systems or application channels interlock. They cannot be cured by a single privacy policy.
Where the external interface creates pressure, it is often worth taking a look at website, tracking and privacy policy. There, the publicly visible processing is brought together with the technical and organisational reality.
When an incident has to be dealt with under time pressure
Data breaches, misdirected emails, unauthorised access, compromised accounts or lost data carriers do not become critical only because of the incident itself. They become critical through unclear responsibility, premature communication and incomplete investigation of the facts. Anyone who reacts carelessly here often creates new problems in documentation and in the later defence.
At such moments, the mandate regularly becomes concentrated in support with data breaches. Notification obligations, communication to data subjects, preservation of evidence and internal management must then all be handled properly at the same time.
When supervisory authorities, data subject rights or deadlines set the pace
Letters from the data protection supervisory authority and far-reaching requests for access often initially look like purely formal questions. In truth, they steer the later record and the quality of internal coordination. They also show whether a company is able to capture its own data reality completely at all. Especially with decentralised systems or unclear roles, this quickly becomes demanding.
Where procedural pressure is in the foreground, representation before the data protection supervisory authority gains importance. Alternatively, in-depth support with a data protection access request matters, depending on which side triggered the conflict.
When data protection is already turning into claims, defence or litigation
In a contentious situation at the latest, the usual compliance language is no longer sufficient. What counts then are facts, evidence, documentation, causation, legal bases for claims and a line that can be sustained in proceedings. This concerns not only Article 82 GDPR. It also concerns injunctive relief, access, internal investigation of errors and communication with several parties at the same time.
Depending on the focus, the mandate often becomes concentrated in GDPR damages or in privacy litigation. This depends on whether the defence against a specific claim or a more comprehensive litigation strategy is in the foreground.
In brief
Six situations usually lead to us: unclear structures, an unreviewed current state, website and tracking, data breaches, supervision and access requests, and disputes over claims.
Typical cases from our data protection practice
We regularly encounter the following constellations in our advisory work. They are abstracted and simplified. Each review depends on the data flow, roles and status of proceedings in the individual case.
AccessExtensive access request from a former employee
- Starting point
- A former employee requests access to and copies of all data stored about him. At the same time, an employment law dispute is ongoing.
- Key difficulty
- The response must generally be given within one month (Art. 12(3) GDPR). The data is spread across email, the HR system and specialist applications.
- Our work
- We define the scope of the search and the exceptions, align the response with the litigation strategy and take the rights of third parties into account.
- Work result
- Timely response with a copy of the data, internal search documentation and coordinated communication.
Simplified example.
DamagesClaim for non-material damages
- Starting point
- After a data leak, several customers claim damages under Art. 82 GDPR and threaten legal action.
- Key difficulty
- According to the CJEU, a mere infringement is not sufficient. The claimant must show the infringement, damage and causation. However, there is no de minimis threshold.
- Our work
- We examine the incident, the documentation and the consequences asserted for each claimant. We then develop a uniform line for defence or settlement.
- Work result
- Statement to the claimants, line of argument for possible lawsuits and advice on preserving evidence.
Simplified example.
Work sample
Customer list sent to the wrong recipients
An employee sends a spreadsheet with customer data to the wrong mailing list. The error is noticed the next morning. The real difficulty: it must be clarified whether there is likely to be a risk to the data subjects. If so, notification to the supervisory authority is required within 72 hours of becoming aware of it (Art. 33 GDPR). We clarify the facts, assess the risk and document the decision. We also examine whether the data subjects must be informed under Art. 34 GDPR. Result of our work: a risk assessment, a notification to the authority or a reasoned decision not to notify, and a documentation memo for the company.
The scenario is anonymised and simplified; it describes how we work, not the outcome of any specific proceedings.
Typical cases are a data breach with a 72-hour deadline, an access request with a one-month deadline and claims under Art. 82 GDPR.
The core legal questions beneath the surface
Data protection usually becomes expensive when basic questions are asked too late. Almost every escalated situation can be traced back to a few core legal issues. Who processes what, for what purpose, in what role, on what basis, in what chain and with what documentation?
What role does your company have in the specific processing?
The distinction between controller, processor and joint controllership is not a theoretical label. It determines information obligations, rights to issue instructions, contract architecture, liability and the later ability to defend yourself. Especially with platforms, software-as-a-service models and complex chains of service providers, this role is often described too generously or too simply.
Where the question of roles is not properly settled, a precise data processing agreement (AVV, Art. 28 GDPR) often becomes the key document. It must reflect the interface between legal responsibility and real service provider practice. For data processing agreements with service providers and SaaS providers, our interactive DPA check is also available to you.
Is the processing substantively sound and can it be evidenced within the company?
Legal basis, purpose limitation, storage limitation, transparency, access and erasure must not only be legally justifiable. They must also be traceable and manageable internally. It becomes particularly problematic when departments, tools and operational routines diverge and there is no longer a reliable overall picture.
In such situations, often only a good record of processing activities shows whether the company really knows its data processing or has only described it formally.
Is there an increased risk that needs to be examined more closely in advance?
Novel, sensitive or extensive processing cannot be secured with standard sentences. Profiling, large-scale analysis, sensitive data, comprehensive monitoring, data processing in the employment context or the use of new technologies may require an in-depth risk analysis. In many cases, this also applies to personal data in connection with artificial intelligence.
Where the intrusion goes deep, a robustly conducted data protection impact assessment creates the basis for presenting risks, countermeasures and proportionality in a comprehensible way.
How do service providers, transfers and external interfaces interlock?
International data flows, support access from third countries, global cloud structures, marketing platforms, applicant systems or distributed development environments rarely make data protection difficult because of a single tool. Rather, it is the overall architecture that becomes critical. Who accesses what, from which country, with which subcontractor and with what transparency?
In such constellations in particular, it pays to look at the website set-up, service provider contracts, transfer logic and organisational evidence not separately but along one line.
- Templates are used even though the product, the chain of service providers and data flows have long since changed considerably.
- Access requests, authorities or incident response are answered before a reliable set of facts has been established internally.
- Documents exist but do not describe the actual processing.
- Data protection is reduced to the public website, although HR, internal systems, sales and contract management form the larger attack surface.
Four questions underpin every data protection mandate: role, legal basis with evidence, risk of the processing and the interplay of service providers and transfers.
Services and work results at a glance
Which documents we review, draft or revise is determined by the mandate. The table shows typical results and the page with further details.
| Service | Work result | More |
|---|---|---|
| Review the current stateAudit | an audit report with a list of priorities on legal bases, service providers, transfers and organisation. | Data protection audit |
| Build data protectionSet-up | roles, processes and core documents for a robust data protection organisation. | Data protection set-up |
| Bind service providers contractuallyAVV (DPA) | a reviewed or newly drafted data processing agreement. | Data processing agreement |
| Document processingVVT (RoPA) | a record of processing activities that reflects actual practice. | Record of processing activities |
| Assess risky processingDSFA (DPIA) | a documented data protection impact assessment with measures. | Data protection impact assessment |
| Review website and trackingExternal presence | a review of consent, tools and privacy policy with a list of changes. | Website, tracking and privacy policy |
| Handle a data breachIncident | risk assessment, notification and communication to data subjects, and proper documentation. | Help with data breaches |
| Conduct proceedings with authoritiesSupervision | statements to the supervisory authority based on well-organised facts. | Representation before the supervisory authority |
| Defend or enforce claimsDispute | a strategy for access, damages and court proceedings. | GDPR damages · Privacy litigation |
In brief
Every matter has a clear work result. The link under “More” leads to details and the matching service package.
Data breach or letter from an authority?
We secure deadlines and organise the facts.
Where data protection merges into other regimes
Digital mandates rarely fall neatly into just one area of law. This makes a clear focus all the more important. Sometimes the case is actually shaped by contract logic, data access, security architecture or the regulation of artificial intelligence. Anyone who makes data protection the main theme there loses time and does not work on the actual risk.
Data protection law and information technology law
Does the mandate depend mainly on software contracts, changes to services, project management, liability, licensing issues or exit scenarios? Then the focus often shifts to information technology law. Data protection remains a decisive part of the contract and implementation architecture but is not necessarily the governing regime.
Data protection law and data law
As soon as commercial data access, data use, interoperability, portability, cloud switching or obligations under the Data Act largely determine the mandate, data law often becomes the more precise perspective. Data protection law remains indispensable there when personal data is affected. However, it does not fully answer every data question.
Data protection law and artificial intelligence
Some projects are dominated by provider or deployer obligations, classification, transparency requirements, human oversight, technical documentation or governance. The benchmark is then the European Union's Artificial Intelligence Regulation (KI-Verordnung / AI Act). In these cases, AI law and the operational implementation of the AI Act often provide the central structure. Data protection law remains highly important for training data, models relating to personal data, data subject rights and accountability obligations.
Data protection law and cybersecurity
A security incident is not automatically a notifiable personal data breach. Conversely, a data protection incident can trigger technical, organisational and liability-related security issues that go well beyond personal data. When incident response, security organisation, supply chain, obligations under the NIS 2 Directive or governance dominate, the interface with cybersecurity and IT compliance becomes central.
platform models, software-as-a-service structures, e-commerce set-ups, internationally rolled-out tool landscapes and staff-intensive companies. Added to this are data-driven sales, due diligence processes, investor requirements and products with a close interface to artificial intelligence. There, it is rarely a single obligation that decides. What usually counts is the entire data and decision-making architecture.
IT law, data law, AI law and cybersecurity are closely adjacent. We determine which regime governs the case and take data protection into account there.
How a legal question becomes a robust solution
Robust data protection work begins with clarity. Companies do not need legal noise but a comprehensible sequence. We uncover the facts, determine roles and obligations, set priorities, synchronise the documentation and already take any later communication into account.
1 · Disclose the processing
First, the actual processing is disclosed: groups of data subjects, data categories, systems, service providers, countries involved, access paths, technical reality and commercial purpose. Without this basis, even formally correct answers quickly go awry.
2 · Classify legally
Then comes the legal classification. This concerns roles, legal bases, information obligations, storage logic, erasure, international transfers, particular risks and documentation. Added to this is the question of which documents and measures actually have to hold up in the specific case.
3 · Prioritise
The third step is prioritisation. Not every open issue is equally urgent. It often makes more commercial sense to first close the points that most strongly affect liability, deadlines, contact with authorities, contract conclusion, enterprise reviews or procedural vulnerabilities.
4 · Evidence and communication
Finally, it is about evidence and communication. A good data protection concept must not only work internally. It must also remain consistent in statements, responses to data subjects, contract negotiations or court disputes.
If data protection is to be set up as an ongoing corporate function, an outsourced legal department and an external data protection officer often interlock in a commercially sensible way.
We disclose the processing, classify it legally, prioritise the open issues and ensure evidence that remains consistent externally.
Data protection terms briefly explained
- Verantwortlicher (controller)
- Body that alone or jointly with others decides on the purposes and means of processing (Art. 4(7) GDPR).
- Auftragsverarbeiter (processor)
- Service provider that processes personal data on behalf of and on the instructions of the controller. A contract under Art. 28 GDPR is required.
- Gemeinsame Verantwortlichkeit (joint controllership)
- Two or more bodies jointly determine purposes and means. They must regulate their obligations in an arrangement (Art. 26 GDPR).
- Verzeichnis von Verarbeitungstätigkeiten (record of processing activities)
- Overview of all processing operations with purpose, data categories, recipients and erasure periods (Art. 30 GDPR).
- Datenschutz-Folgenabschätzung (data protection impact assessment)
- Prior review of processing operations likely to result in a high risk to data subjects (Art. 35 GDPR).
- Datenpanne (data breach)
- Personal data breach (Art. 4(12) GDPR). If there is a risk, it must be reported to the supervisory authority within 72 hours (Art. 33 GDPR).
- Drittlandübermittlung (third-country transfer)
- Transfer of personal data to countries outside the EEA. It is only permitted under the conditions of Art. 44 et seq. GDPR.
- Endgerätezugriff (access to terminal equipment)
- Storing or reading information on terminal equipment, for example through cookies. Consent is generally required (Section 25 TDDDG).
The explanations are simplified. The statutory text, guidelines and case law in the individual case are decisive.
Statutes, guidelines and authority standards
Data protection law in companies is not decided by buzzwords but by statutes, guidelines and case law that is constantly evolving. Anyone who is responsible internally or has to make external statements should work with the sources that supervisory authorities and courts actually rely on.
General Data Protection Regulation on EUR-Lex (opens in a new tab)
The General Data Protection Regulation forms the core of the European data protection framework. For companies, legal bases, transparency, data subject rights, processing on behalf and international transfers are particularly relevant. Data breaches, data protection impact assessments and damages also count. Whether a project triggers a data protection impact assessment can be narrowed down in advance with the DPIA initial check.
German Federal Data Protection Act on gesetze-im-internet.de (opens in a new tab)
The German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) supplements the General Data Protection Regulation in German law. In corporate mandates, it plays a significant role in the employment context, in procedural questions and in individual national particularities, among other things.
German Telecommunications Digital Services Data Protection Act on gesetze-im-internet.de (opens in a new tab)
The German Telecommunications Digital Services Data Protection Act (TDDDG) becomes particularly relevant for cookies, tracking, similar technologies and access to terminal equipment. For website, app and marketing constellations, looking at the General Data Protection Regulation alone is therefore often not enough.
European Data Protection Board guidelines on data breaches (opens in a new tab)
The guidelines of the European Data Protection Board help to classify whether a security event constitutes a notifiable personal data breach. They also show whether communication to data subjects is required and how the risk logic should be structured.
Guidance of the Federal Commissioner for Data Protection and Freedom of Information on data protection impact assessments (opens in a new tab)
The guidance of the Federal Commissioner for Data Protection and Freedom of Information (BfDI) is particularly valuable when a high-risk processing operation has to be examined. This concerns the intensity of the intrusion, prior review and methodological documentation.
In everyday business, the same documents often carry the load again and again: record of processing activities, data processing agreement, privacy notices, erasure and authorisation concepts and the documentation of technical and organisational measures. Added to this are incident logs and, where there is increased risk, a data protection impact assessment. It is not their mere existence but their consistency with the processing actually carried out that determines their value.
The GDPR, BDSG and TDDDG form the framework. Guidelines from the EDPB and BfDI show how authorities review.
Statutes, deadlines and case law in data protection law
The following table brings together the provisions that most frequently carry weight in corporate mandates. The links lead to the official text.
| Provision | Content | Practical significance |
|---|---|---|
| Art. 5 GDPR (opens in a new tab) | Principles of processing | Purpose limitation, data minimisation, storage limitation and accountability. |
| Art. 6 GDPR (opens in a new tab) | Lawfulness of processing | Every processing operation needs a legal basis. |
| Art. 12, 15 GDPR (opens in a new tab) | Right of access and deadline | Response generally within one month, extension by two months possible. |
| Art. 26, 28 GDPR (opens in a new tab) | Joint controllership and processing on behalf | Contractual regulation of roles and obligations. |
| Art. 30 GDPR (opens in a new tab) | Record of processing activities | Key evidence document vis-à-vis the supervisory authority. |
| Art. 33, 34 GDPR (opens in a new tab) | Notification and communication of data breaches | Notification within 72 hours if there is a risk to data subjects. |
| Art. 35 GDPR (opens in a new tab) | Data protection impact assessment | Mandatory where a high risk is likely. |
| Art. 44 et seq. GDPR (opens in a new tab) | Transfers to third countries | Adequacy decision, standard contractual clauses or other appropriate safeguards. |
| Art. 82, 83 GDPR (opens in a new tab) | Damages and fines | Liability towards data subjects and fines imposed by the supervisory authority. |
| Section 38 BDSG (opens in a new tab) | Appointment of a data protection officer | Generally mandatory from 20 persons constantly engaged in automated processing. |
| Section 25 TDDDG (opens in a new tab) | Protection of privacy in terminal equipment | Consent for cookies and tracking unless an exception applies. |
| CJEU, judgment of 4 May 2023 – C-300/21 (opens in a new tab) | Damages under Art. 82 GDPR | An infringement alone is not enough. Infringement, damage and causation are required; there is no de minimis threshold. |
Important deadlines are 72 hours for notifying a data breach and one month for responding to an access request. According to the CJEU, damages require proven damage.
FAQ on data protection law for companies
These answers provide a sound initial orientation. Which line holds in the specific mandate nevertheless depends on the data flow, allocation of roles, status of proceedings, technical reality and quality of documentation.
When does data protection law govern the mandate and when does the focus shift to another area of law?
Data protection law governs the mandate above all when personal data, legal bases, transparency obligations, data subject rights or international transfers form the core. The same applies to data breaches, communication with authorities or damages. If the matter is primarily about software contracts, project logic, breaches of performance and chains of title, information technology law often comes to the fore. For commercial data access, data use and Data Act questions, data law is often more precise. If provider, deployer or transparency obligations under the European Union's Artificial Intelligence Regulation predominate, AI law and the operational line on the AI Act are more likely to govern. ITMR Rechtsanwälte assigns your case to the appropriate focus at the outset.
Is a privacy policy sufficient if the company wants to appear compliant externally?
No. A privacy policy can create transparency. However, it does not replace a sound legal basis, correct roles, robust contracts, clean data flows, erasure logic, the ability to respond to access requests or incident management. In many companies, the policy looks orderly from the outside, while internally neither responsibilities nor processing operations are really documented consistently. That is why, for externally visible digital projects, the in-depth review of website, tracking and privacy policy often only takes full effect when the underlying processes are considered as well. ITMR Rechtsanwälte therefore reviews the policy and the processes together.
Does every data breach have to be reported within 72 hours?
No. Not every security event is automatically a notifiable personal data breach. What matters is whether there is likely to be a risk to the rights and freedoms of natural persons. However, every incident must be recorded, investigated, legally classified and documented promptly. If the situation is unclear or external communication has already taken place, the deadline question quickly becomes linked with governance, technology and liability. Structured handling of the data breach is then often the appropriate first step. ITMR Rechtsanwälte supports you with the risk assessment and the notification.
Does every data protection infringement automatically lead to damages?
No. Article 82 of the General Data Protection Regulation provides a claim for damages, but not every breach of duty automatically leads to compensable damage. In 2023, the CJEU clarified that a mere infringement is not sufficient (C-300/21). In practice, the infringement, causation, demonstration of non-material or material damage and current case law are decisive. Such questions become particularly relevant in cases of misdirected emails, data leaks, unlawful disclosure, unlawful further processing or problematic communication with data subjects. Where claims and defence determine the line, the topic becomes concentrated in GDPR damages and, closer to litigation, in privacy litigation. ITMR Rechtsanwälte represents companies in defending against such claims.
When is an external data protection officer sufficient and when should legal representation be added?
An external data protection officer can take on monitoring, advice, training and structural support. Sometimes, however, proceedings before authorities, international transfers, contentious access requests, claim-related incidents, contractual conflicts, deadline pressure or court disputes are added. This creates an additional need for legal assessment and representation by a lawyer. In such situations, the functions often complement each other. The external data protection officer supports the ongoing organisation, while the lawyer conducts the conflict or escalation legally. ITMR Rechtsanwälte offers both functions from a single source.
Lawyers at ITMR for data protection law
Data protection mandates require legal precision, technical classification, an understanding of contracts and a reliable feel for proceedings. What matters, therefore, are not buzzwords but Fachanwalt titles (certified specialist lawyer titles), additional qualifications and the ability to bring data protection together with corporate reality.
Jean Paul P. Bohne, LL.M., MM
- Certified Information Privacy Professional/Europe (CIPP/E)
- Certified Information Privacy Manager (CIPM)
- External data protection officer [TÜV]
- Data protection officer [TÜV]
- Data protection auditor [TÜV]
- IT compliance manager [TÜV]
Andreas Buchholz
- External data protection officer
- Data protection officer [TÜV]
- E-commerce manager [IHK, Chamber of Industry and Commerce]
- Forensic and procedural experience
- Particularly strong in commercially driven conflict situations
Dominik Skornia, LL.B.
- External data protection officer
- Practice focus on data protection law, data law and privacy litigation
- Close to operational data protection practice and dispute-related implementation
- Particularly relevant for data subject rights and documentation-related conflicts
Corporate data protection mandates often require more than mere knowledge of individual provisions. What is regularly needed is the Fachanwalt title in information technology law, in-depth data protection qualifications and experience with service provider and contract architectures. Added to this is the ability to anticipate regulatory and procedural dynamics early on. This is precisely where robust additional qualifications show their practical value.
Data protection mandates are handled at our firm by two Fachanwälte für IT-Recht (certified specialist lawyers for IT law) with data protection certifications and a lawyer specialising in data protection.
When a specific decision is now pending
The more clearly the initial situation is described, the faster a legally and commercially sound line can be developed. Typically, a mandate becomes concentrated in one of the following situations.
You need order in processes, contracts and documentation
Data protection has sometimes grown alongside the business for years without responsibilities, documents and approval logic coming together properly. Then a selective correction rarely helps. Often only the combination of data protection audit, data protection set-up, data processing agreement and record of processing activities provides the necessary stabilisation.
You are under deadline pressure or in ongoing proceedings
Perhaps a data protection supervisory authority has made an enquiry, an access request needs to be answered or an incident is already escalating internally. What counts then is not the longest statement but a properly managed set of facts. In this situation, representation before authorities, handling access requests and incident support often interlock.
The matter has already become claim-related or contentious
Where data protection no longer just has to be organised but defended, the focus shifts. What counts then are evidence, presentation, causation, communication discipline and a line that holds up in court. It is precisely in this situation that mandates often become concentrated in GDPR damages or the more litigation-oriented field of privacy litigation.
Data protection in a company rarely becomes critical at the moment a provision is read. It becomes critical where a decision has to be defended under time pressure, with commercial implications or vis-à-vis third parties. Anyone who sets up this line properly at an early stage gains not only legal certainty. They also gain the ability to act in product, HR, sales, technology and conflict situations.
ITMR Rechtsanwälte PartGmbB · Düsseldorf · Data protection lawyer: GDPR advice, representation before authorities.
Legal status: 23 October 2026. Reviewed on 23 October 2026. This overview provides initial orientation and does not replace a review of the specific data flow and proceedings.
Responsible lawyer for data protection law at ITMR
Jean Paul P. Bohne, LL.M., MM
Rechtsanwalt (attorney) | Partner | Business mediator
- Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law)
- Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
- AI Officer (KI-Beauftragter) [DEKRA]
- Certified Information Privacy Professional/Europe [CIPP/E]
- Cert. Information Privacy Manager [CIPM]
- External data protection officer [TÜV]
- Data protection officer [TÜV]
- Data protection auditor [TÜV]
- IT compliance manager [TÜV]
Data protection law expert at ITMR
T: +49 211 737547-70
E: bohne@itmr-legal.de
Andreas Buchholz
Rechtsanwalt (attorney) | Partner
- Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
- External data protection officer
- Data protection officer [TÜV]
- E-commerce manager [IHK]
Data protection law expert at ITMR
T: +49 211 737547-70
E: buchholz@itmr-legal.de
Dominik Skornia
Rechtsanwalt (attorney) | employed
- AI Privacy Expert (GDDcert. EU)
Data protection law expert at ITMR
T: +49 211 737547-70
E: skornia@itmr-legal.de