5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Data protection set-up before go-live
Data protection before launch is an approval decision.
We review the launch and relaunch of websites, shops, apps and SaaS offerings where product, marketing, technology and management decide at the same time. This creates a clear launch line.
Please enter a short description first.
The first contact is free of charge. Before any costs arise, we will explicitly inform you.
Response within 24 hours on working days
As of: 23 October 2026
Data protection before the shop launch1 of 6
- Data flows recordedPresent
- Consent matches trackingPixel loads before consentMissing
- DPA with payment and shipping providersCheck
- Privacy notices match the productNewsletter missingCheck
- Complete the recordfollow up after launchMissing
- Third-country aspects clarifiedCheck
Blocker: Tracking starts without consent
- 1Record the situationProduct and date
- 2Prioritise blockersBlockers and residual points
- 3Prepare the launchBasis for decisions
Schematic illustration of a go-live review. Simplified example.
We review the launch of
- Websites
- Online shops
- Apps
- SaaS offerings
Key points at a glance
- Before a digital product launches, consent, tracking, service provider contracts, privacy notices and evidence must match the actual processing.
- Not every open point prevents the launch.
- At ITMR, we separate genuine blockers from residual points that can be followed up with clear responsibility.
- You receive a basis for decisions on launch, relaunch, customer review or management approval.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Classification
Why is data protection before launch more than a text?
In our experience, cookie banners, tracking, service providers, privacy notices, DPA, RoPA and third-country questions all land on the table at the same time shortly before launch.
We clarify what must be in place before launch, what can follow with assigned responsibility and what needs its own review.
It is not enough to add a privacy policy at the end. The actual processing must match the external presentation, the consent, the integrated tools, the contracts and the evidence.
A cookie banner can be visible while the tracking works differently on a technical level. A DPA can exist while the roles are wrong. A privacy policy can appear complete although customer data, SDKs, hosting or third-country aspects are missing.
Ready to launch does not mean that every detail is finished. Ready to launch means that the key risks have been identified, prioritised and assigned to a clear decision.
- For whom
- Companies before launch or relaunch
- Products
- Website, shop, app, platform, SaaS
- Provisions
- GDPR and § 25 TDDDG
- Result
- Blocker list and launch line
Date in view
Tell us the product and launch date in the form. We will get back to you on working days within 24 hours with an initial classification.
How it works
How do we prepare the launch?
We align our review with the launch date.
01
Record the situation We place data flows, tracking, tools, service providers, texts and deadlines in the actual logic of your product.
02
Prioritise blockers We separate genuine obstacles to launch from points that can be documented, refined or dealt with later.
03
Prepare the launch You receive a clear basis for decisions on launch, relaunch, customer review, management approval or implementation.
What we review before launch
- 1
Product and data flows Which data is collected, where does it flow, which user roles exist and which teams have access?
- 2
Consent and loading behaviour Does the consent match cookies, SDKs, advertising tools, forms, newsletter, customer data and actual integration?
- 3
Privacy notices Do the notices describe the real processing or an ideal state that does not match the tools and processes?
- 4
DPA and service provider chain Which providers are integrated, who is a processor, which subcontractors exist and where does something need to be refined?
- 5
RoPA, DPIA screening and evidence Which processing operations must be documented, where is an in-depth risk review indicated and which documents do you need for customers?
- 6
Third-country aspects Which hosting, maintenance, analytics or subcontractor structures lead to international data transfers, and how does that affect the launch?
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service package
What do you receive for the launch decision?
Service package: data protection set-up
Blocker list before launch Clear classification of the points that must be resolved before launch or relaunch so that the launch decision is defensible.
Approval and residual risk situation Separation between genuine launch problems, residual points that can be documented and topics for a follow-up review.
Shared launch line A briefing with which management, product team, legal department and data protection make the same decision instead of shouting out individual points.
Follow-up route Concrete next steps for consent, privacy notices, DPA, RoPA, DPIA screening, third-country questions or responsibilities.
- For whom
- Companies before launch or relaunch
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical implementation and ongoing support as data protection officer. These are separate services, on request.
Who delivers what and who decides
- Product description and launch date
- List of tools and service providers
- Existing privacy notices
- Information on consent
- Review of the data protection situation
- Blocker list
- Prioritised residual points
- Follow-up route
- Your management decides on the launch
- Your team decides on implementation
How does the engagement work?
- 1
First assessment You describe the product and launch date using the form. We assess what needs to be clarified before launch. The first contact is free of charge.
- 2
Offer Before work begins, we tell you the scope and costs transparently.
- 3
Court steps separately We agree court proceedings and representation before supervisory authorities separately if you wish.
Typical situations
When do companies contact us before launch?
We help identify risks early and prepare the approval so that the date holds. We see these six situations most often.
Cookie banner, analytics tools, campaign pixels, forms or consent management have been changed and need to be assessed before publication.
Customer account, payment provider, newsletter, customer database, shipping and privacy notices must fit together before launch.
Analytics, push notifications, permissions, app store information, third-party SDKs and user communication are about to be approved.
Hosting, maintenance access, subcontractors, DPA, technical measures and evidence for major customers must be explainable.
Users, providers, operators, payment providers, moderation and interfaces create data flows that must be organised before launch.
Marketing or sales want to launch while DPA, transfers, consents and documentation are still open. Our data flow designer gives a first overview.
Blockers and residual points
What blocks the launch and what can follow?
Blockers are points without whose correction the launch is not defensible. Other points may follow if they are documented and assigned and no sham approval arises.
- Tracking or SDKs without appropriate consent
Key providers without a contract Notices do not match the processing Roles or third-country aspects cannot be explained
Refine the record of processing activities Sharpen the wording of notices Complete DPA annexes and lists of subcontractors Schedule DPIA screening or transfer review
Digital products
Why does the solution differ depending on the product?
The same data protection question arises differently depending on the product.
Consent, tracking, forms, newsletter, embedded services, privacy notices and contracts with agency and host.
Ordering process, customer account, payment, shipping, customer database, reviews and marketing interlock.
SDKs, app store information, push, device permissions, analytics and crash reports shape the data protection situation.
Hosting, maintenance access, roles, customer contracts, subcontractors and evidence for business customers are the focus.
Avoid mistakes
What weakens data protection before launch?
We see these four mistakes in our go-live reviews.
It can be well worded and still miss the actual situation of tools, service providers and data flows.
Banner, SDKs and tracking must fit together technically, legally and in documentation. A nice banner does not replace provable consent.
DPA, subcontractors, technical measures and third-country aspects become important when customers or investors demand evidence.
Without separating blockers, residual points and follow-up modules, the result is standstill or a weak approval.
Next routes
When is another service package a better fit?
The set-up is the right starting point when several questions together affect the launch. If a single topic dominates, a narrower path reaches the goal faster.
When mainly the website, privacy policy, banner and tracking are to be reviewed.
When the DPA, service provider chain or approval of a tool is the bottleneck.
When the documentation of individual processing operations needs to be refined.
When risky processing requires an in-depth assessment.
When not a launch but the entire data protection status is to be reviewed.
When the data protection function is to be taken over on an ongoing basis.
Legal framework
Which rules apply before launch?
Under Section 25 TDDDG, information may generally only be stored on or read from the terminal device with consent, unless access is strictly necessary for the requested service.
Art. 13 GDPR requires users to be informed on collection about purposes, legal bases, recipients and third-country transfers. For service providers, a data processing agreement is required under Art. 28 GDPR.
Art. 30 GDPR requires a record of processing activities. Transfers to third countries are only permitted under the conditions of Art. 44 et seq. GDPR.
- General Data Protection Regulation (EUR-Lex) Art. 13, 28, 30, 35 and 44 et seq. GDPR.
- Section 25 TDDDG Protection of privacy in terminal equipment, consent for cookies and similar technologies.
- DSK guidance for providers of digital services Guidance from supervisory authorities on tracking and consent.
Limits
What does the go-live review not cover?
The review prioritises. It does not replace full implementation of all data protection obligations.
- 1
No technical implementation Your team or agency integrates banners and configures tools. We review the result legally.
- 2
Residual points remain tasks What may follow after launch must be completed with assigned responsibility and a date. Otherwise the residual point becomes a risk.
- 3
Short notice only with documents We also support shortly before launch if the situation is clearly described and the documents are available.
Mistakes we see shortly before launch
- Pixels load before consent.
- The agency has integrated services that nobody has covered by contract.
- Management, product team and data protection have no shared launch line.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Excellent advice & implementation in data protection and AI - highly recommended for startups.” (translated from German)
“Great advice and service on media law” (translated from German)
“Mr Bohne is an excellent lawyer. He really took his time, listened attentively and gave me clear recommendations on how to set up my app in Germany in a GDPR-compliant way, including tips on typical pitfalls.” (translated from German)
FAQ
What do companies ask about the set-up before launch?
When is a data protection set-up before launch useful?
When a website, shop, app, platform or SaaS is about to launch and several data protection questions are open at the same time, such as consent, tracking, service providers, notices, DPA, RoPA, DPIA screening or third-country aspects.
Is a privacy policy enough for the launch?
In our experience, often not. The policy must match the actual processing. If tools, tracking, forms, SDKs, hosting or service providers are involved, consent, contracts, roles and evidence must also be right.
Is the review only intended for websites?
No. It fits websites, shops, apps, platforms and SaaS products. What matters is the moment of launch or relaunch, not the interface.
What is the difference from the GDPR website check?
The website check fits when the privacy policy, banner, tracking and website functions are the focus. The set-up fits when product, tool, contract and evidence topics have to be decided together.
Which documents help with the initial review?
Product description, launch date, list of tools and service providers, privacy notices, information on consent, DPA documents, an overview of data flows and the question to be decided before launch.
When does this become a DPA, RoPA or DPIA question?
When a single topic shapes the launch decision. The go-live review prioritises. Afterwards, we review the DPA, RoPA, DPIA or transfers in a targeted way.
Do you also support at short notice before launch?
Yes, if the situation is clearly described and the documents are available. We then quickly clarify what must be in place before launch and what can follow.
Next step
Is your launch date already set?
If a launch date, relaunch, app store approval, campaign or roll-out with a major customer is already under way, a clear decision counts. We assess whether your set-up allows the launch and where the genuine blockers lie.
Helpful for your enquiry
- Product description
- Launch date
- List of tools and service providers
- Privacy notices
You can also submit documents after our first response.
Discuss your go-live situation
State the product, launch date and open questions. We classify blockers and residual points.
Helpful are a product description, launch date, list of tools and service providers and existing privacy notices.
Related services
Data protection law Compliance, contact with authorities and data subject rights.GDPR website check Review website, banner and tracking.Data processing agreement Classify service providers contractually.record of processing activities Documentation under Art. 30 GDPR.data protection impact assessment Assess risky processing.Data protection audit Review your overall data protection status.
From our blog: Joint controllership · Tracking without consent