5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Help with data protection authorities
The first response shapes the proceedings.
We classify the supervisory authority's letter, clarify the facts with your team and handle the statement and communication with the authority, from the first statement through to ongoing correspondence.
Please enter a short description first.
The first contact is free of charge. We will expressly inform you before any costs arise.
Response within 24 hours on working days
As of: 23 October 2026
Complaint by a data subject, hearing
We have received a complaint regarding an incompletely answered access request .Clarify the facts
We request a statement and submission of the record of processing activities.Check the scope
We point out the possibility of measures under Art. 58 GDPR .Classify the escalation
Point of review: What must be submitted, what is voluntary?
- 1Send the letterDeadline, occasion, file
- 2Clarify the situationFacts, evidence
- 3Conduct the responseAuthority decides
Schematic illustration of a letter from an authority. Simplified example.
We support proceedings before
- State authorities
- BfDI
- Supervisory authorities in other EU countries
What should you do first?
- Note the date of receipt and the deadline of the letter. An extension can be requested if the facts have not yet been clarified.
- Do not respond hastily or without an agreed chronology. What you write to the authority will later count as your account.
- Do not change or delete any documents without a traceable change history.
Key points at a glance
- A letter from the data protection authority can start harmlessly and still shape the further proceedings.
- Under Art. 31 GDPR, companies must cooperate with the authority, but should only respond once the type of proceedings, deadline, facts and evidence have been clarified.
- At ITMR, we classify the letter, align the facts with your team and handle the statement.
- If a fine is threatened, we defend you in the further proceedings.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- DSFA
- Data protection impact assessment under Art. 35 GDPR. It assesses the risks of a processing operation before it starts.
Typical occasions
When do companies need help dealing with the authority?
In our experience, the problem rarely lies in the individual provision. We make sure the response reflects the facts correctly, avoids contradictions and meets deadlines.
We clarify the procedural situation before you make any binding statement to the authority.
A complaint, a follow-up question on a data breach notification or a general request for information can turn into a review of legal bases, data subject rights, technical measures, processing on behalf, deletion concepts or third-country transfers.
Before every response, we therefore check which facts are confirmed, what still needs to be clarified, which documents are reliable and whether remedial measures are documented.
A good response is cooperative but controlled. It is complete enough to show cooperation and precise enough not to create unnecessary concessions or new review questions.
- For whom
- Companies with a letter from a data protection authority
- Obligation
- Cooperation under Art. 31 GDPR
- Powers of the authority
- Art. 58 GDPR
- Fines
- Art. 83 GDPR
Quick situation assessment
Upload the letter in the form. We will get back to you on working days within 24 hours with an initial classification of the deadline and procedural situation.
How it works
How do we support you in proceedings with the authority?
From the first classification to the statement, we coordinate every step with you.
01
Send the letter You send the letter, the deadline, previous correspondence and existing documents such as RoPA, DPA, notification, technical measures or an internal chronology.
02
Clarify the situation We check whether it concerns a request for information, complaint, hearing, audit, remedial measure, order or fine, and what must be clarified before responding.
03
Conduct the response We draft the response, manage follow-up submissions and deadlines and, on request, take over all communication with the authority.
What we clarify before the statement
- 1
Type of letter Requests for information, complaint proceedings, hearings, audits, requests for further documents, orders or fine proceedings require different responses.
- 2
Deadline and competence We document deadlines, extensions, the competent authority and the stage of proceedings early on.
- 3
Facts Chronology, systems, data types, roles, service providers and internal communication must fit together.
- 4
Evidence RoPA, DPA, technical measures, DPIA, deletion concept, privacy notices, tickets and approvals must match the actual processing.
- 5
Response line The statement explains, substantiates and limits, without unverified admissions or unnecessary additional information.
- 6
Consequences We review effects on fines, data subject claims, employees, customers and reputation.
Service package
What do we take on in proceedings with the authority?
Service package: help with the supervisory authority
Situation assessment Classification of the letter, deadline, competent authority, stage of proceedings, allegation and possible escalation.
Fact-finding Alignment of technology, data protection organisation, data protection officer, business unit, management, service providers and documentation.
Statement and correspondence Drafting and coordinating the response, including evidence, remedial measures and limits of disclosure.
Fine risk Review of hearing, fine risk, assessment factors, legal remedies and proportionality.
Internal communication Briefing for management, internal messaging and clear responsibilities.
Follow-up Adjustment of RoPA, DPA, technical measures, processes and reporting channels if the proceedings revealed gaps.
- For whom
- Companies and organisations in contact with data protection authorities
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Action against an order and court fine proceedings. These are separate services, on request.
Who delivers what and who decides
- Letter and deadline
- Internal chronology
- Existing evidence
- Contacts in IT and the business unit
- Classification of the procedural situation
- Alignment of the facts
- Statement
- Communication with the authority
- Your company decides on the response
- The authority decides on measures and fines
- In a dispute, the court
How does the engagement work?
- 1
First assessment You send the letter using the form. We classify the deadline and procedural situation. The first contact is free of charge.
- 2
Offer Before work begins, we tell you the scope and costs of the support transparently.
- 3
Court steps separately If you wish, we agree an action against an order and defence in court fine proceedings separately.
Typical occasions
Which letters from the authority do we see most often?
Have the letter classified before the first response.
The authority requests information on a processing operation, a tool, a complaint or an organisational measure.
An allegation has been raised. The statement can influence whether the proceedings escalate or are contained.
After a notification, the authority asks about the cause, risk assessment, remedy, informing data subjects or technical measures.
The authority reviews evidence, demands process changes or announces measures such as erasure, restriction or prohibition.
A hearing letter or an assessment by the authority indicates possible fine proceedings.
Data protection officer, IT, management, service providers and business unit assess the same incident differently.
Risk points
Where do proceedings with authorities fail in practice?
In our experience, proceedings rarely become difficult because of the incident, but because of an uncoordinated reaction afterwards.
The response goes out before the chronology has been agreed internally.
IT statements do not match the legal assessment, or the data protection officer communicates without an agreed line.
Documents are corrected without the change history remaining traceable.
Information on service providers, subcontractors or access remains vague.
Parallel data subject claims, customer enquiries or press interest are not taken into account.
Information beyond the necessary response opens up new review questions.
Preparation
Which documents help with the initial assessment?
These documents speed up the first classification.
- Letter, hearing, order or request for further documents
- Deadline note and previous correspondence
- Competent supervisory authority
- Internal chronology of the incident
- Notifications or statements already sent
- record of processing activities
DPA and documents on service providers Technical measures, tickets and reports Privacy notices, consents, deletion concept or DPIA Internal roles and approvals
Legal framework
Which rules apply in proceedings before the authority?
Under Art. 31 GDPR, controllers and processors cooperate with the supervisory authority on request. Under Art. 58(1) GDPR, the authority can request information and carry out investigations.
Under Art. 58(2) GDPR, the authority can, among other things, issue warnings and reprimands, give orders, restrict or prohibit processing and impose fines.
Fines are governed by Art. 83 GDPR. The authority takes into account, among other things, the nature, gravity and duration of the infringement, intent or negligence and measures taken to mitigate the damage.
Under Section 41 BDSG, the provisions of the Administrative Offences Act also apply to fine proceedings. A judicial remedy against orders of the authority is available under Art. 78 GDPR.
- General Data Protection Regulation (EUR-Lex) Official text, in particular Art. 31, 33, 34, 58, 78 and 83 GDPR.
- EDPB Guidelines 04/2022 on the calculation of fines European guidelines on the calculation of fines under the GDPR.
- Federal Data Protection Act National provisions on supervision, procedure and fines.
Limits
What can legal support not achieve?
We improve your starting position. The authority makes the decision.
- 1
The authority decides Whether the authority discontinues the proceedings, issues a reprimand or imposes a fine is its own decision or, in a dispute, a court's.
- 2
No change to the facts We present the facts in an organised and substantiated way. What happened cannot be reinterpreted after the fact.
- 3
Cooperation remains mandatory You must provide the required information. We check what is required and what goes beyond it.
Mistakes that make proceedings harder
- The response goes out without an agreed chronology.
- The deadline expires without an extension having been requested.
- Documents are corrected without a change history.
- Voluntary additional information opens up new review questions.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Mr Otto Weidenkeller handled my problem in the area of e-commerce … with full attention and seriousness and in the end even achieved a better result than initially expected.” (translated from German)
“Very good advice. Absolutely recommended.” (translated from German)
“Ms Kürsch successfully supported me in proceedings against a tech group. The cooperation was very pleasant, solution-oriented and above all effective.” (translated from German)
FAQ
What do companies ask about letters from the authority?
Do we have to respond to a letter from the data protection authority?
As a rule, yes, because Art. 31 GDPR requires cooperation. But only respond once the type of proceedings, deadline, facts and evidence have been reviewed.
Should the authority receive all documents straight away?
Not without review. You must provide the required information. We check voluntary additional information for whether it opens up new risks or contains unverified facts.
What is particularly important in a hearing?
A hearing can influence whether proceedings are discontinued or end in a remedial measure, reprimand, order or fine. Beforehand, we assess the allegation, evidence, fault, remedy, documentation and economic consequences.
When does an enquiry turn into a fine risk?
The risk rises when the authority examines specific infringements, such as late notifications, missing legal bases, insufficient security or contradictory statements. At the latest at a hearing, the proceedings need a defence strategy.
Whom should we involve internally?
In our mandates, we involve management, the legal department, the data protection officer, IT, security, the business unit and affected service providers. Every binding statement is preceded by a shared factual basis.
Can you take over communication with the authority?
Yes. We review letters, manage deadlines, organise facts and evidence, draft statements and conduct communication with the authority as your lawyers.
Next step
Have you received a letter from the authority?
Have it classified before the first response. We clarify the procedural situation, deadline and response line and handle the statement.
Helpful for your enquiry
- Letter from the authority
- Deadline and date of receipt
- Previous correspondence
- Short chronology
You can also submit documents after our first response.
Have the letter from the authority classified
Upload the letter and state the deadline. We classify the procedural situation and response line.
Helpful are the authority's letter, the deadline, previous correspondence and a short chronology.
Related services
Data protection law Data protection organisation, roles, legal bases and data subject rights.Data breach assistance Risk assessment, notification and informing data subjects after an incident.record of processing activities When the authority wants to trace processing operations.Data processing agreement Service providers, cloud and subcontractors in contact with the authority.Data protection audit Review processes and evidence after an objection.DSGVO-Schadensersatz When data subjects assert claims in parallel.
From our blog: CJEU on the authority's discretion · GDPR fines