The data protection officer has left, the supervisory authority still has his name
The appointment was in the file, the notification to the supervisory authority went out four years ago, the website still shows the old address. Then the person changes, and none of the three places finds out. What Art. 37 GDPR and IT-Grundschutz require for officers, and why an appointment only becomes a problem when it ends.
Read more
Yes to which text?
Article 7 GDPR requires the controller to be able to demonstrate consent. A tick box with a date only proves that someone said yes at some point. The European Data Protection Board asks for more: the information the person saw at that moment. Why the version of the consent text is the actual evidence, and what has to happen after a substantial change.
Read more
Green without evidence
From 27 September 2026, "eco-friendly" without evidence, "climate neutral" via offsetting and labels without certification are on the blacklist of unfair commercial practices. Directive (EU) 2024/825 targets the website, and there usually nobody knows on how many pages "sustainable" appears.
Read more
Keeping is not contacting
After a trade fair the contacts are there, and the question is usually whether you may keep them. That is the easier half. Why the GDPR permits storage, why German unfair-competition law still blocks the marketing email, and why the B2B relief is missing exactly there.
Read more
The biggest data store is a mailbox
No system accumulates as much personal data as an organization's email mailboxes: bank details, ID scans, sick notes, passwords in plain text. Two questions bring this to light, and both arrive under time pressure: what data do you hold about me? And: who is affected by this incident?
Read more
Two lists nobody reconciles
The data processing agreement and the register of processors describe the same service providers, from two angles. Legally they belong together, in practice they are two separate lists that drift apart. Why exactly this gap surfaces in an audit, and how the register entry can be derived from the contract itself.
Read more
Deletion is a process, not a button
The GDPR demands deletion, commercial and tax law demand retention, and both apply at the same time. Whoever deletes by gut feeling is guaranteed to violate one of the two duties. Why a deletion concept needs periods per data type, when a period even starts running, and why proving deletion is half the duty.
Read more
The consent banner that sets cookies before anyone clicks
A study of one million websites found in 2025: on roughly 43 percent, tracking cookies run without valid consent. The TDDDG requires the opposite. Why the gap almost always comes down to nobody knowing what their own site really loads, and how to find out.
Read more