Data protection & data law: Whoever processes data
owes accountability.

The General Data Protection Regulation (DSGVO/GDPR) demands more than lawful processing. It demands proof that the processing is lawful, for customer data as much as for the data of your own employees, for software procurement as much as for transfers to third countries. Alongside it, data law determines who may use and share data, regardless of whether the data relates to an identifiable person. Where both bodies of rules meet on the same data set, the distinction decides lawfulness and liability.

Lead counsel: Christian Galetzka · deputy lead: Patrizia Frankenberger.

Illustration for data protection: database

What we do.

Compliance & documentation

Legal assessment of processes relevant under data protection law in your company — in software procurement, in contractual relationships with business partners and processors, in the introduction of new systems. Art. 5(2) GDPR demands both: lawfulness and proof of it. That proof runs through the documentation — records of processing activities, data protection impact assessments, data processing agreements, technical and organizational measures. We set it up so that it holds up in daily practice and serves as evidence when it counts. Prepared in a practical way, not bloated.

Data breaches

After a ransomware attack or a hack of your IT systems, the question arises within hours whether personal data has ended up in the hands of unauthorized third parties. Two decisions hang on it: the notification to the competent supervisory authority under Art. 33 GDPR and the communication to the data subjects under Art. 34 GDPR. We make these decisions with you, document them, and handle the communication with the supervisory authority. First steps and your notification deadlines after an attack: Cyber Emergency.

Data law

Advice on the Data Governance Act and on data contracts: data intermediaries, data spaces, data altruism, data licenses in B2B relationships. Plus the question of at what point machine data becomes personal data. The Data Act expressly leaves the GDPR untouched (Art. 1(5)); with mixed datasets, only the distinction determines which body of rules grounds the access and which limits it. We address the Data Act's manufacturer obligations under Cybersecurity & data economy.

Third-country transfers & risk

Transfers to third countries under Chapter V of the GDPR: selection of the transfer mechanism, standard contractual clauses, Transfer Impact Assessment, assessment of adequacy decisions. Schrems II has shown that an adequacy decision can be challenged and struck down; whoever relies on it alone is left without a basis afterward. Plus the gray areas that have not yet been conclusively resolved: identifiability in pseudonymized data, training data for AI systems, interfaces between the GDPR, the AI Act, and the Data Act.

Two legal regimes, one subject area

The GDPR governs what you must protect.
Data law governs what you must make accessible.

The compliance triad

Three pillars.

Ensuring that personal data is processed lawfully and data subjects are properly informed.
Implementing technical and organizational measures.
Comprehensively documenting the processing of personal data.

Focus areas & mandates.

[ Selection ]

Employee data
Employee monitoring

Employee data protection and employee monitoring

Data protection in the employment context is among the most conflict-prone areas of GDPR application. We advise companies on employee monitoring, on the introduction of technical systems with surveillance effects, and on the legally sound design of recruiting, HR and performance processes.

The tension between § 26 BDSG (German Federal Data Protection Act), the GDPR and § 87 Abs. 1 Nr. 6 BetrVG (German Works Constitution Act) is an advisory topic in its own right — and it grows with every new AI tool in HR.

Works councils
Codetermination

Works councils: data protection training and codetermination advice

Works councils bear a special responsibility when new IT and AI systems are introduced — codetermination under the BetrVG meets data protection under the GDPR. Both areas require works councils to keep their knowledge current — a need that recent legislative reforms have expanded considerably.

We offer training for works council bodies on data protection and employee monitoring — also in combination with our AI training for works councils, when the council must at the same time assess new AI systems in the workplace. In addition, we advise in ongoing codetermination procedures and act as external experts where we are retained for that purpose.

Incident
Art. 33 GDPR, § 32 BSIG

When several reporting chains run at once

The 72-hour deadline of Art. 33 GDPR runs from awareness, with no allowance for weekends and holidays. Whoever meets it has clarified beforehand who assesses, who notifies, and who speaks to the supervisory authority. The decision against notifying also belongs in the record; it is the first thing a supervisory authority will later ask about.

If the same incident also hits a connected product or an entity under the BSI Act (BSIG), further reporting chains with their own triggers, deadlines, and recipients run in parallel. We keep them together in one matter, jointly with our practice area Cybersecurity & data economy.

Websites
§ 25 TDDDG

Tracking, cookies, and consent

Storing information on the end user's device and accessing it require consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act, successor to the TTDSG) as a rule — regardless of whether personal data is processed in doing so. Only at the second stage does the question of the legal basis for the subsequent processing arise.

We review consent banners and their design, the integration of analytics and marketing services, third-party fonts and maps, and the contractual and information obligations that follow from them. Mistakes here are visible from the outside and easy to prove — and therefore the most frequent trigger for complaints and cease-and-desist warnings (Abmahnungen).

Supervision
Art. 83 GDPR

Supervisory and fine proceedings

Representation before the data protection supervisory authorities — from answering a request for information through the hearing to the fine notice and the objection against it. Plus support in audits initiated on specific grounds and the post-incident review.

The range under Art. 83 GDPR extends to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. In practice, what matters more than the range is what a company can prove in the proceedings. Whoever has documented their processing negotiates from a different position.

Data subject rights
Art. 15, 17 & 82 GDPR

Access, erasure, compensation

We assert data subject rights under the GDPR — access (Art. 15) as well as erasure and delisting (Art. 17), including against search engines. We cover the "right to be forgotten" and action against inaccurate search results in depth under Social media law.

Alongside these stands compensation for non-material damage under Art. 82 GDPR. In the Facebook scraping cases, the Bundesgerichtshof (Germany's Federal Court of Justice) held that the mere, even brief, loss of control over one's own personal data can in itself constitute non-material damage; no misuse of the data or further impairment needs to be added (judgment of November 18, 2024, VI ZR 10/24). The amounts in individual cases remain low; the number of proceedings does not. We advise both on enforcing such claims and on defending against serial claims after a data leak.

In-house
Remote training

Training for companies and legal departments

Training formats on the GDPR, employee data protection, data protection impact assessments, and data law: from a basic module for mixed employee groups to advanced sessions for data protection officers and legal departments. Dates on request via our office.

Frequently asked questions.

[ FAQ ]

Question 01
Appointment

When do we have to appoint a data protection officer?

As soon as, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data (§ 38 Abs. 1 BDSG). Regardless of headcount, the obligation applies, among other cases, where a data protection impact assessment is required or where the core activity consists of large-scale processing of health data.

Question 02
Access requests

How quickly do we have to answer a data subject access request?

Without undue delay, and at the latest within one month of receipt (Art. 12(3) GDPR). The deadline can be extended by up to two further months where necessary, taking into account the complexity and number of requests, provided you inform the data subject within the first month and give reasons. An employment dispute does not change the deadline. If you refuse an excessive request, you must also give reasons within one month (Art. 12(4) GDPR).

Question 03
Processing on behalf

When do we need a data processing agreement?

Whenever a service provider processes personal data on your behalf and on your instructions, for example for hosting or sending newsletters (Art. 28(3) GDPR). If the provider decides on the purposes and means alone or jointly with you, it is itself a controller. The transfer then needs its own legal basis and, in the case of joint control, an arrangement under Art. 26 GDPR as well.

Question 04
Third countries

May we use cloud and AI services from the US?

Yes, if the processing otherwise complies with the GDPR and the transfer to the US is safeguarded. The US as a whole is not considered to offer a level of data protection comparable to the EU. The EU-U.S. Data Privacy Framework facilitates transfers only to self-certified US companies. It is likely still sufficient for now, even though measures taken by the US government are currently seriously calling the validity of the Data Privacy Framework into question. For providers that are not certified, appropriate safeguards under Art. 46 GDPR are required, usually standard contractual clauses together with an assessment of the law in the recipient country. We recommend the clauses for certified providers as well.

Question 05
Supervisory authority

The supervisory authority has written to us. Do we have to respond?

That depends on the type of letter. You must answer a request for information in supervisory proceedings (§ 40 Abs. 4 BDSG). In a hearing in administrative fine proceedings, there is no obligation to comment on the matter. The right to refuse information where answering would be self-incriminating belongs to natural persons. Whether companies can also rely on it is disputed. So first clarify which type of proceedings you are dealing with.

A specific matter?
Let's talk.

Book an initial assessment info@jun.legal

Contact persons · Data protection & data law

Phone+49 931 6639232Emailinfo@jun.legal

Data protection & data law: Whoever processes dataowes accountability.