GDPR & Data Protection
Record of processing activities, processing on behalf of a controller, technical and organisational measures under Art. 32, DPIA, cookie banners, Schrems II, personal data breach notification — the GDPR practice track for SMEs in Germany and Austria.
The key GDPR topics in detail
Step-by-step guides with templates, regulatory references and audit checklists.
GDPR Guide 2026
Obligations, Fines, Practical Roadmap for SMBs
Creating a record of processing activities 2026
Excel template + 14 SME examples + 9 mandatory fields
Data processing agreement template 2026 (Art. 28 GDPR)
Model contract + 8 mandatory contents + Schrems II annex
Technical and organisational measures under Art. 32: eight-area checklist
Catalogue of 60 measures · state of the art 2026
Cookie banners under § 25 TDDDG
Equal choice + 12-point audit · German law
Schrems II + DPF update 2026
Trump EO + 12 EU alternatives
Personal data breach notification within 72 hours
Art. 33/34 GDPR step by step
GDPR fine proceedings: 8 steps
From receipt of the complaint to litigation
When is a data protection officer mandatory?
§ 38 BDSG (DE) + cost comparison, internal vs. external
DE/AT: what is identical — and what is not. The GDPR is an EU regulation. All the articles cited here — Art. 28 (processing on behalf of a controller), Art. 30 (record of processing activities), Art. 32 (technical and organisational measures), Art. 33/34 (notification within 72 hours), Art. 35 (DPIA) and Art. 83 (fines of up to EUR 20 million or 4 % of worldwide annual turnover) — apply in identical wording in Germany and Austria. What differs is supervision and national supplementary law:
- Supervision: in Germany, the state data protection authorities designated under state law supervise non-public bodies (§ 40(1) BDSG); for federal public bodies, the Federal Commissioner for Data Protection (BfDI) is responsible (§ 9(1) BDSG). In Austria, the Austrian Data Protection Authority (Datenschutzbehörde) alone is responsible — it is established as the national supervisory authority under Art. 51 GDPR (§ 18(1) DSG).
- National supplementary law: in Germany the German Federal Data Protection Act (BDSG), in Austria the Austrian Data Protection Act (DSG). Where our articles cite '§ … BDSG', that is German law.
- Data protection officer: the threshold of 'as a rule at least 20 persons permanently engaged in automated processing' comes from § 38(1) BDSG and applies only in Germany. Austria has no numerical threshold: there, the duty to designate follows directly from Art. 37 GDPR; § 5 DSG additionally governs only confidentiality and freedom from instructions in the public sector.
- Cookies: § 25 TDDDG (the German Telecommunications-Digital-Services Data Protection Act, which since 14 May 2024 has been the successor designation of the TTDSG) is a German provision and does not apply in Austria. The requirements for consent itself follow in both countries from Art. 6(1)(a) and Art. 7 GDPR.
- National penalty provisions alongside Art. 83 GDPR: in Germany § 43 BDSG (fine of up to EUR 50,000), in Austria § 62(1) DSG (administrative penalty of up to EUR 50,000).
Listicles & top lists
Compact overviews — ideal for board meetings, newsletters or as an A4 print template.
Practice clusters & glossary
Specialist topics for sectors, use cases and mandatory terminology.
Audit-ready in 2-4 hours
Instead of months of research: ready-to-use templates, personalised with your company name, a one-off investment instead of consultancy fees.
View the GDPR Kit →Sources
- Regulation (EU) 2016/679 (GDPR) — German full text, EUR-Lex (As at: 27 April 2016, applicable since 25 May 2018)
- German Federal Data Protection Act (BDSG) — gesetze-im-internet.de (As at: continuously updated, BMJ service unit; § 9, § 38, § 40, § 43 BDSG)
- German Telecommunications-Digital-Services Data Protection Act (TDDDG) — gesetze-im-internet.de (As at: continuously updated, § 25 TDDDG; successor designation of the TTDSG since 14 May 2024)
- Austrian Data Protection Act (DSG, Austria) — RIS, version in force (As at: continuously updated, § 5, § 18 and § 62 DSG)
- European Commission — data protection main page (As at: continuously updated)
- European Commission — Digital Omnibus press release (As at: 19 November 2025, trilogue ongoing)
All articles on DSGVO (32)
- Cookie Banner 2026: Implementing § 25 TDDDG + Art. 6 GDPR correctly
Compliant cookie banner under § 25 TDDDG + Art. 6 GDPR: 7 banner obligations, ECJ C-673/17 Planet49, BGH I ZR 7/16, OVG rulings 2025. Includes 12-point.
- Create GDPR Records of Processing 2026: Excel Template + 14 SME Examples
Complete guide to creating GDPR Records of Processing Activities (Art. 30): 9 mandatory fields, 8-step process, 14 SME examples. Excel template.
- Data Breach Notification 72h: Step-by-step Procedure (Art. 33+34 GDPR)
Complete 72-hour data breach notification procedure under Art. 33 GDPR: detect, classify, notify authority, inform data subjects (Art. 34), document.
- Data Protection Officer: When Is a DPO Required in 2026?
DPO obligation under Art. 37 GDPR and Section 38 BDSG: required from 20 employees with data access in Germany. Plus special obligations regardless of size.
- DPA with Microsoft 365: Mandatory 2026 Adjustments for GDPR
Microsoft's standard DPA is not enough for GDPR compliance. EU Data Boundary, Copilot tenant isolation, US sub-processors, Schrems II — six required.
- DPA Template 2026: What to include, what not (Art. 28 GDPR)
Complete DPA template under Art. 28 GDPR with 8 mandatory clauses, 14 sub-processor examples, Schrems II / DPF annex. Status 04/2026.
- DPF Collapse Plan B: 12 EU Alternatives to US Tools (2026)
Plan B for a Data Privacy Framework collapse: 12 EU alternatives to Microsoft 365, Salesforce, Slack, AWS — migration effort, cost, and risk reduction.
- DPIA for HR Recruiting AI: 7-Step Template (2026)
Data Protection Impact Assessment for AI-driven recruiting tools: bias testing, applicant risk, safeguards, supervisory consultation. § 22 AGG and Article.
- GDPR 2026: 6 Cost-Saving Tips for SMEs (EUR 30-60k/year)
Six practical cost-saving levers for GDPR compliance in SMEs: external DPO, Compliance Kit, EU providers, cookieless analytics. Up to EUR 60,000 saved per.
- GDPR 2026: 8 Free Starter Tools for SMEs
Eight free tools to start GDPR compliance: self-assessment, RoPA Excel template, privacy policy generators, supervisory reports, practical SME utilities.
- GDPR + EU AI Act for AI Applications: Double Obligation 2026
GDPR + EU AI Act for AI applications: how Art. 22 GDPR meshes with Art. 14 EU AI Act, the DPIA + FRIA double assessment, and the SCHUFA case law line.
- GDPR for Associations: 8 Membership Management Obligations
GDPR for associations and clubs: membership management, privacy notice in admission form, newsletter consent, photos online, retention after exit.
- GDPR Cloud Migration: 12-Point Checklist
GDPR-compliant cloud migration: 12 points covering TIA, DPA, exit plan and data return clauses. Pre-migration, migration and post-migration phases.
- GDPR Complete Package Austria: What AT Companies Need Differently
GDPR compliance for Austrian SMEs: AT-specific aspects (DSG, Datenschutzbehörde as supervisory authority, DPO obligation without headcount threshold), 14 typical processing activities.
- Cookieless Marketing Future 2026+: 5 GDPR-Compliant Strategies
Cookieless marketing after the end of third-party cookies and under GDPR 2026: five strategies covering server-side tracking, first-party data, contextual.
- GDPR Digital Personnel File: 5 Obligations and Retention
GDPR-compliant digital personnel file: 5 obligations (access, retention, deletion, data subject access, export). Specifics for applicants and employees.
- GDPR Employee Monitoring: 6 Limits and the BAG Line
GDPR employee monitoring 2026: Section 26 BDSG plus BAG (Federal Labor Court) jurisprudence — screen recording, keyloggers, AI performance tracking, works.
- GDPR Fines 2025/26: Tracker and SME Reality Check
Tracker of the largest GDPR fines 2025/26: TikTok, Meta, Vodafone, Deutsche Wohnen. The 14 documents supervisory authorities miss in 80 percent of cases.
- GDPR Fining Procedure: 8 Steps After a Complaint
From complaint receipt to payment: 8-step procedure under §§ 41 ff. BDSG, procedural rights, defense strategy, BVerwG 6 C 6.20 file access, fine.
- GDPR for International Customers: Territorial Scope (Art. 3)
GDPR territorial scope under Art. 3: when EU rules apply to US, UK and Asian customers. Multi-jurisdiction compliance practice for SMEs.
- GDPR Marketing 2026: Newsletter, Advertising, Profiling
GDPR-compliant marketing 2026: newsletter consent, advertising cookies, profiling, retargeting, personalization — practitioner guide with fine examples.
- GDPR for Medical Practices and Therapists: 8 Obligations
GDPR in medical practice: patient data under Art. 9, KIS software, eRezept interface, medical confidentiality (Section 203 StGB), telematics.
- GDPR for Mobile Apps: 6 Practical Obligations 2026
GDPR for mobile apps: TDDDG Section 25, App Tracking Transparency, push notifications, in-app advertising, child-directed apps and SDK audits.
- GDPR for SaaS Providers: 10 Obligations 2026
GDPR for SaaS providers: 10 obligations from DPA template to customer lockbox, sub-processor management, EU data boundary, breach notification, and data.
- GDPR for Tax Advisors and Law Firms: Client Data Specifics
GDPR for tax advisors and law firms: client data, professional secrecy under Section 203 StGB (German Criminal Code), and the BayLDA 2024 clarification.
- Top 10 GDPR Mistakes SMEs Make in 2026
The 10 most common GDPR mistakes among SMEs in 2026: outdated RoPA, missing DPAs, manipulated cookie banners. Median fine EUR 12,500. Quick-fix plan.
- GDPR for Trades and Construction SMEs: 6 Common Pitfalls
GDPR in trades and construction: customer data, GPS-based employee tracking, on-site photo documentation, subcontractor DPAs and WhatsApp communication.
- GDPR Video Surveillance at the Workplace: Section 4 BDSG and DPIA
GDPR-compliant workplace video surveillance: Section 4 BDSG, DPIA obligation, BAG (Federal Labor Court) rulings, signage, retention, works council.
- RoPA for E-Commerce: 8 Typical Processing Activities
Records of Processing Activities (RoPA) for online shops: order fulfillment, customer account, newsletter, cookies, reviews, shipping, returns, marketing.
- Schrems II + DPF Update 2026: Status After Trump-2 Administration
EU-US Data Privacy Framework status 04/2026: Trump executive order impact, EDPB opinion 03/2026, TIA requirement, SCC update, EU alternatives matrix for.
- TOM under Art. 32 GDPR: 8-Area Checklist + 12 SME Measures
Technical and organizational measures (TOM) under Art. 32 GDPR: 8 areas, 12 SME minimum measures, state of the art 2026. Documentation requirements +.
- TOM Basic Package for SMEs: 12 Minimum Measures
Technical and Organizational Measures (TOM) under Art. 32 GDPR for SMEs: 12 minimum measures for 50-250 employees, state-of-the-art 2026 plus practical.