Data protection in companies – the essentials

Whether it’s customer management, personnel files, or contact forms: Almost every company processes personal data. The General Data Protection Regulation (GDPR) provides the legal framework for this. But which obligations are particularly important—and how can companies get started in a structured way?

By gaining an overview of their own data processing activities, establishing clear responsibilities, and implementing appropriate safeguards, companies can create a solid foundation for their data protection efforts.

What data falls under the GDPR?

Personal data is information relating to an identified or identifiable natural person. This includes, for example, names, contact information, bank details, and employee information. Technical information such as IP addresses can also constitute personal data.

The term “processing” encompasses virtually every interaction with this data: collection, storage, analysis, disclosure, and deletion. Data protection therefore affects numerous business areas—from sales to accounting to human resources.

The Most Important Principles of Data Protection

The GDPR requires responsible and transparent handling of personal data. Companies should take the following principles into account in particular:

1. Lawfulness and transparency: Data processing must have a legal basis and be transparent to data subjects.
2. Purpose limitation: Data is collected for specified purposes. Any subsequent use for other purposes must be reviewed separately.
3. Data minimization: Only the data necessary for the specific purpose should be collected.
4. Accuracy: Personal data must be factually correct and, where necessary, up to date.
5. Storage limitation: Data may not be retained indefinitely.
6. Confidentiality and Security: Appropriate measures must be taken to protect data against unauthorized access, loss, and other damage.

In addition, there is the requirement for accountability: Companies must be able to demonstrate compliance with data protection principles.

Every processing activity requires a legal basis

Consent is not required for every instance of data processing. Depending on the situation, for example, the performance of a contract, a legal obligation, or a legitimate interest may serve as a legal basis.

For instance, processing a shipping address may be necessary to fulfill an order. Retaining certain invoice documents, on the other hand, is based on legal obligations.

The appropriate legal basis must be assessed for the specific purpose. A legitimate interest, in particular, requires a balancing of interests. Additional requirements apply to specially protected information, such as health data.

Provide privacy notices in an understandable manner

Companies must inform data subjects about how they process their data. This includes, among other things, information on purposes, legal bases, recipients, retention periods, and data subject rights.

A privacy policy on the website does not automatically cover all disclosure requirements. Separate notices may also be required for employees, job applicants, or customers.

Our recommendation: Provide the information where the respective data processing begins, and check whether adjustments are necessary when introducing new applications or processes.

Document data processing activities

The record of processing activities provides an overview of which personal data is processed within the company and for what purposes. Typical entries relate to human resources management, customer service, accounting, or newsletter distribution.

The exemption for companies with fewer than 250 employees is very limited. Routine processing activities, such as human resources or customer management, can trigger a documentation requirement even for small businesses.

A well-maintained record also helps to transparently document responsibilities, service providers used, and intended retention periods.

Protecting Data Through Appropriate Measures

The technical and organizational measures required depend on the nature of the processing and the risks to the data subjects. Typical measures include:

1. Individual user accounts and clearly defined access rights.
2. Multi-factor authentication, especially for sensitive access points.
3. Regular updates and the patching of known security vulnerabilities.
4. Data backups, including verified recovery options.
5. Appropriate encryption and secure transmission channels.
6. Training on handling personal data.

Data protection should be taken into account as early as the selection and setup of new systems. This includes, for example, data-minimal default settings and limited access rights.

Review Service Providers and Retention Periods

Hosting, cloud storage, or external payroll processing: Service providers are often involved in the processing of personal data. If a provider processes data on behalf of the company, a data processing agreement is generally required. The service provider’s actual role must be assessed beforehand. Additional requirements may apply when transferring data to countries outside the European Economic Area.

Clear deletion rules are equally important. Companies should determine when data is no longer needed and which legal retention obligations prevent its deletion. These rules must then also be implemented in the systems used.

Organizing Data Subject Requests and Data Breaches

Under the respective legal conditions, individuals may request, among other things, access to, correction of, or deletion of their data. Companies need reliable processes for this. Requests must generally be answered without delay, at the latest within one month; an extension is possible only under certain conditions.

There should also be a procedure in place for data breaches. Such an incident can occur, for example, due to a misdirected email, a lost device, or unauthorized system access.

A report to the supervisory authority is generally required if the breach is likely to pose a risk to the rights and freedoms of natural persons. It must be submitted without delay and, if possible, within 72 hours of becoming known. If the risk is likely to be high, the affected individuals must generally be informed as well. Data breaches must be documented even if no report is required.

How Companies Can Get Started in a Structured Way

To get started, we recommend five steps:

1. Conduct an inventory: Identify data processing activities, applications, storage locations, and service providers.
2. Define responsibilities: Designate internal contacts and determine whether a data protection officer must be appointed.
3. Prioritize action: Assess risks and address urgent security gaps first. If a high risk is anticipated, also evaluate the need for a data protection impact assessment.
4. Implement documents and procedures: Create or update privacy notices, contracts, the record of processing activities, and deletion policies.
5. Review regularly: Train employees and incorporate data protection into new projects and changed processes.

Even without the obligation to appoint a Data Protection Officer, companies must comply with the data protection requirements that apply to them.

Support for Data Protection in Your Company

Would you like to establish a structured data protection framework or review existing measures? We can help you identify areas requiring action, set priorities, and develop suitable solutions for your day-to-day business operations.

Contact us to discuss your data protection organization.

Sources and Legal Basis

1. General Data Protection Regulation: In particular, Articles 4–6, 9, 12–22, 25, 28, 30, and 32–37 on terms, principles, and corporate obligations. eur-lex.europa.eu
2. EDSA: Lawful Processing of Personal Data: Explanations of the legal bases. edpb.europa.eu
3. BfDI: Record of Processing Activities: Guidelines and templates for documentation. bfdi.bund.de
4. EDSA: Security of Personal Data: Guidance on technical and organizational safeguards. Data Protection Guide for Small Businesses
5. EDSA: Data Breaches: Information on documentation, reporting, and notification. Data Protection Guide for Small Businesses
6. Section 38 of the Federal Data Protection Act: Supplementary German regulations on the appointment of a data protection officer.