Is your data protection
ready for AI?

In Germany a Data Protection Officer is mandatory once, as a rule, at least 20 people are permanently engaged in the automated processing of personal data. Regardless of headcount, the obligation also applies where there is large-scale processing of special categories of data (Art. 9 GDPR, e.g. health data) or systematic monitoring. Anyone who is required to appoint a DPO but fails to do so risks a fine in itself.

An external Data Protection Officer brings ready-to-use expertise without the need to train internal staff or trigger special protection against dismissal. For most SMEs, the external solution is more predictable and usually less expensive than an internal position. Important: authorities require a named natural person as the DPO, not just a company.

Yes. As the responsible company you remain accountable for GDPR compliance, even when you use an AI tool from a service provider. As a rule you will need a Data Processing Agreement under Art. 28 GDPR and you must check where the data flows. Responsibility can be regulated by contract, but it cannot be fully handed off.

The starting point is a 45-minute consultation via video call for 150 €, in which you receive a risk assessment and a prioritised action list. Beforehand you can complete the AI Compliance Check free of charge. Ongoing support as an external Data Protection Officer is agreed individually depending on scope.

The consulting serves companies and self-employed professionals subject to the EU GDPR and the EU AI Act (across the EU/EEA and beyond). Consultations are available in English and German and take place remotely via video call, so you can take part from anywhere.

The EU AI Act is the European Union’s regulation on artificial intelligence. It has been in force since August 2024 and applies in stages: prohibited AI practices and the obligation to ensure AI literacy (Art. 4) have applied since February 2025, the obligations for general-purpose AI models since August 2025, and the bulk of the high-risk obligations follow from August 2026. Practically every company that uses or offers AI is affected — the extent of the obligations depends on the risk of the specific use.

Yes. Since February 2025, Art. 4 of the EU AI Act requires companies to ensure a sufficient level of AI literacy among employees who use AI systems. No particular format is prescribed; the training must match the systems in use and the staff’s tasks. Documented training also helps to avoid data protection breaches caused by improper use.

In principle yes — but with clear rules. You need a legal basis for the processing, as a rule a Data Processing Agreement with the provider (Art. 28 GDPR) and clarity on whether data flows to third countries. Personal or confidential data only belongs in an AI tool if it is properly safeguarded under data protection law. An internal AI policy and trained employees are the most practical way to use AI in a legally sound manner.

A Data Protection Impact Assessment under Art. 35 GDPR is a risk analysis carried out in advance for processing that is likely to result in a high risk to the rights and freedoms of data subjects — for example large-scale profiling, systematic monitoring or the use of new technologies such as AI. It documents risks and countermeasures and is often mandatory exactly where AI meets personal data.

The GDPR sets out two tiers in Art. 83: up to 10 million € or 2% of worldwide annual turnover, and for serious breaches up to 20 million € or 4% of worldwide annual turnover — whichever amount is higher. The individual case is always decisive. Even a missing legal basis, or a required but unappointed Data Protection Officer, can be sanctioned.