Service: Data Protection & Compliance

Data Protection & Compliance, pragmatic.

Data protection should protect your business, not paralyse it. Since 2018 I have guided around 30 small and medium-sized businesses through GDPR implementation, from medical practices through retail and trades to education providers. As a certified data protection manager I deliver compliance that is documented, understandable and workable in daily business. Currently added: Data Act and AI Act, what AI use in your company allows and what it doesn't.

Book a call All data protection references

What you can commission

Complete GDPR Implementation

Inventory, records of processing activities, legal bases, TOMs, within a few weeks, cleanly documented.

DPAs & Service Providers

Data processing agreements, third-country transfers, standard contractual clauses, your tool landscape made legally sound.

Privacy Policy & Website

Legal texts that reflect the actual state of your website, instead of boilerplate that auditors notice.

Workshops & Training

Employee training with cases from your own business, including Data Act and AI Act.

E-Learning Content

Training modules on GDPR, cybersecurity and AI, produced for your industry.

Ongoing Support

Annual brush-ups, new processing activities, new tools, compliance stays current.

GDPR quick check

How solid is your setup?

Eight questions, honest answers, a non-binding first assessment. Nothing is stored or transmitted.

01: Do you have an up-to-date record of processing activities?

02: Do you have data processing agreements with all service providers (hosting, cloud, newsletter …)?

03: Is your website's privacy policy current and complete (covering all tools in use)?

04: Is there a defined process for data subject requests (access, erasure, deadline: 1 month)?

05: Are retention periods or an erasure concept defined for personal data?

06: Are your employees bound to confidentiality and trained on data protection?

07: Is there a process for data breaches (72-hour notification duty)?

08: Are your technical and organisational measures (access, backups, encryption) documented?

How it works

Initial call

30 minutes, free. You describe your situation and goal: I'll tell you honestly whether and how I can help.

Analysis & proposal

A concrete proposal that fits the task, as a project, ongoing advisory or a performance-based model. With a clear scope and timeline.

Execution & steering

From sparring to execution, with measurable interim results and direct communication.

References from this practice

All data protection references ↗

Fachstelle NÖ

Data protection training and consulting on the Data Act and AI Act, legally sound client communication and AI use.

Around 30 SMEs since 2018

Records of processing, DPAs, privacy policies and workshops, from medical practices to education providers.

Horeca Hero

E-learning content on GDPR, cybersecurity and AI for the hospitality industry.

Frequently Asked Questions

Do I need an external data protection officer?

Most SMEs are not obliged to appoint a data protection officer, but they still need a documented implementation. What applies in your case is clarified in the initial call.

How long does GDPR implementation take in an SME?

Typically a few weeks: inventory, records of processing, agreements, texts, training, with clear milestones instead of a never-ending project.

Does the consulting also cover AI topics?

Yes. Training on the AI Act and Data Act, rules for AI use in your company, and e-learning modules on GDPR and AI are part of the core offering.

Free tool

Does your website really need a cookie banner?

10 questions based on the EU ePrivacy rules, with a banner-free replacement for every consent-requiring technology. This website itself runs without cookies and without a banner.

Start the cookie banner check