Lawyer for IT compliance: legal register, governance, policies

When IT compliance becomes a management task

Quick start: what is your matter about?

Your contact: Jean Paul P. Bohne, LL.M., MM

Partner, Fachanwalt für IT-Recht (certified specialist lawyer for IT law) and Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law), IT Compliance Manager (TÜV). Together with Dr. Alexander Pleh, Fachanwalt für IT-Recht.

Send an IT compliance enquiry

What happens after your enquiry?

After your enquiry, we will get back to you within 24 hours on working days. The first contact is free of charge. Before any costs are incurred, we will tell you so explicitly.

1. A short description is enough. Briefly describe the occasion, such as an audit, product launch, change of service provider or incident. Existing policies, key contracts, an organisational chart of responsibilities and current deadlines are helpful.
2. Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
3. Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

Typical cases from our IT compliance practice

The following constellations are abstracted and simplified. How a case turns out depends on the business model, documentation and regulatory context.

What you will have at the end

What IT compliance has to achieve here

On this page, IT compliance means the robust organisation of legally relevant requirements for digital processes, systems, products, data flows, service providers and security structures.

Anyone who only works through individual obligations in isolation loses sight of the actual management question. What counts in a mandate is therefore above all whether the company has a comprehensible overall logic. This includes scope, responsibilities, approvals, contract architecture, risk assessments, management of measures and robust evidence.

What “legal register” (Rechtskataster) means in practice

A legal register here is neither a rigid list of legal provisions nor an Excel graveyard. What is meant is a workable map of obligations that translates digital requirements into operational responsibility.

• Which obligation stems from which regime or contract?
• Which company, product, process or system is affected?
• Who decides, who implements, who controls?
• Which evidence should be available in normal operation, in an audit or in a dispute?
• Which occasion triggers a review, update or escalation?

Regulatory reference points with real practical value

This page does not cover every special regime in detail. It does, however, show which reliable sources the management logic is based on.

• General Data Protection Regulation on EUR-Lex (opens in a new tab)
• NIS-2 Directive on EUR-Lex (opens in a new tab)
• BSI-Gesetz (German BSI Act) on gesetze-im-internet.de (opens in a new tab)
• BSI: NIS-2 applicability check (in German) (opens in a new tab)
• Data Act on EUR-Lex (opens in a new tab)
• AI Act: official overview by the European Commission (opens in a new tab)

The clear boundary is important. Not every obligation affects every company in the same way. Relevance and priority depend on business model, sector, group role, product architecture, data relevance, outsourcing and risk profile. That is why IT compliance must be organised early by triggers and company situations.

When you need us

Mandates rarely arise from a textbook case. Usually there is already a trigger that means handling individual specialist topics side by side is no longer enough.

An audit, due diligence or enterprise customer demands evidence

Then good intentions are not enough. What is expected is robust documentation of roles, approvals, service provider management, contracts, security and data protection logic as well as comprehensible decision-making paths. For this, the data protection audit, the EU Digital Acts Audit and the overarching management on this page are often relevant together.

New product, new market or new technology

With platform functions, connected products, data-driven services or artificial intelligence, the set of obligations often shifts before the launch. Governance, product approval and documentation then have to be in place earlier than many teams assume. In-depth substantive coverage can be found under data law, AI law, implementing the Data Act and implementing the AI Act.

Cloud, outsourcing or a critical change of service provider

Many compliance gaps arise in the contracts rather than in the organisational chart. Anyone relying on software as a service, cloud, managed services, development partners or support structures must organise control rights, audit mechanisms, security requirements, subcontractors, exit and escalation paths in a sound way. Central to this are IT law, IT contract / software contract and, for personal data, the data processing agreement.

An incident, complaint or reporting deadline is looming

A security incident, a data breach or a letter from the supervisory authority often shows within hours whether roles, reporting channels and evidence really hold up. Structured management then counts instead of hectic individual reactions. Depending on the focus, the mandate concentrates on cybersecurity, help with a data breach, help with the data protection supervisory authority or NIS-2 implementation.

Management or the executive board asks: “Where is the evidence?”

At the latest at this point, it becomes clear whether IT compliance holds up as a management model. What is needed then is a verifiable line instead of a loose collection of individual documents. This includes a map of obligations, responsibilities, approvals, contracts, review logic, incident paths and robust management documentation.

For particularly important and important entities, Section 38 BSIG (opens in a new tab) expressly requires management to implement and monitor the risk management measures under Section 30 BSIG (opens in a new tab). It must also regularly attend training. Where there is a recurring need for management, the outsourced legal department is often more economical than a series of isolated individual mandates.

Which evidence should typically be available

Not every company needs the same depth. Without a robust evidence structure, however, governance and compliance quickly become vulnerable in audits, due diligence or conflicts.

Typical documents and records

• a comprehensible obligations matrix or a functioning legal register with scope and prioritisation,
• documented roles, responsibilities, approvals and escalation paths,
• relevant policies, work instructions and process approvals,
• key contractual documents on cloud, outsourcing, development, support, data processing and audit rights,
• evidence of risk analyses, review decisions, acceptances and tracking of measures,
• incident and reporting paths, communication logic and internal decision records,
• training and awareness records, where the regime or the risk profile suggests this,
• a review or update log showing when and why documents were refined.

What is missing particularly often in practice

Individual documents often exist, but there is no reliable connection between them. Typical issues are outdated contract templates, service provider chains that have not been updated, unclear approvals and missing decision papers. Added to this are undocumented risk assessments or an incident path that exists on paper but has not been practised organisationally.

For scheduling, our timeline of digital regulation (in German) with the most important key dates helps.

It is precisely at this point that it is decided whether IT compliance becomes mere formal window dressing or a robust corporate structure. Anyone who closes this gap only under pressure usually pays with delays, rework and unnecessary reputational risk.

When the focus shifts to a special regime

Not every follow-up question should be resolved on this page. As soon as the substantive depth of a regime determines the case, the respective in-depth page is the more precise point of contact.

Further connections exist with privacy litigation and e-commerce law.

How ITMR supports IT compliance mandates

The goal is a robust corporate practice in which obligations, responsibilities, contracts, measures and evidence fit together. An abstract formal programme is of little help here.

Useful connecting points within ITMR

Depending on the case, project-related modules and in-depth pages can follow immediately, such as the EU Digital Acts Audit, NIS-2 implementation, data protection audit, IT contract / software contract, implementing the Data Act or implementing the AI Act. Where there is a recurring need for management, the outsourced legal department is often the economically cleaner route.

Who handles the topic at ITMR

IT compliance mandates often concern the interface between governance, data protection, cybersecurity, contracts and digital regulation. Accordingly, the assignment of personnel should not be left to chance either.

Specialisation signals that matter in this field

Certified specialisation in information technology law (Fachanwaltschaft), an explicit IT compliance qualification, proximity to data protection and cybersecurity, regulatory interfaces with data law, artificial intelligence and open source, as well as project- and litigation-related experience with digital business models.

Key terms in IT compliance

IT compliance

Robust organisation of legally relevant requirements for digital processes, systems, products, data flows and service providers.

Legal register (Rechtskataster)

Workable map of obligations that assigns requirements from laws and contracts to responsibilities and evidence.

Governance

Organisation of roles, approvals, escalation paths and controls within a company.

Risk management measures

Technical and organisational measures under Section 30 BSIG to protect information technology systems.

Important entity

Category of the BSI-Gesetz (German BSI Act) under Section 28 BSIG to which NIS-2 obligations are linked.

Due diligence

Review of a company by investors, buyers or customers, often with evidence requirements regarding IT compliance.

The terms are for orientation. The provisions and contracts in the individual case are decisive.

Provisions and sources

The following sources support the statements on this page. Union law (EU) and German law (DE) are marked separately.

Articles on current compliance obligations

These articles (in German) deal with obligations that currently keep compliance officers particularly busy.

Frequently asked questions from companies

The decisive questions usually concern responsibilities, evidence and the resilience of your own organisation. Legal provisions alone rarely answer them.

Specific next step