Practical knowledge, reports, and news on data protection, GDPR, and compliance — written and regularly reviewed by our team.
Analysis of court rulings, authority decisions and legislative changes that affect small businesses.
Original research and studies from simply Legal and Dieter.
We opened 1,338 websites of medical practices, dental practices, psychotherapy practices and pharmacies three times each. Two out of three pass something on to third-party servers before the first click, just as many as in the other sectors of our study. The causes, however, differ considerably from profession to profession, and so does what you can do about them.
Read more →
10,389 German websites, each visited three times. What sites share about visitors before anyone could consent.
Read more →Practical guides and explainers on data protection, GDPR, and compliance.
A cookie banner is not mandatory for every website. You only need one if your website uses services or cookies that are not strictly necessary. When that is the case, why Google Fonts and maps are more often the reason than tracking, what a banner must be able to do and what the planned EU reform really changes.
Read more →
According to the professional association, small companies typically pay between €150 and €300 a month for an external data protection officer. What one really costs, however, is not decided by the monthly price alone but by the contract term, the scope of services and additional costs. With a worked example comparing internal and external, a checklist for your offer and the status of the planned reform.
Read more →
Poor availability, high costs, one PDF report per year: there are good reasons to switch your data protection officer. Legally it is straightforward, as long as termination, handover and the notification to the supervisory authority happen in the right order. The complete roadmap with a termination letter template, a handover checklist and the mistakes that happen most often when switching.
Read more →
All obligations under Regulation (EU) 2024/1689 after the Digital Omnibus, sorted by actor, risk class and type, with deadlines, fines and filters.
Read more →
The record of processing activities is the first document a supervisory authority wants to see, the deletion concept the second. This guide explains who has to keep a record (almost everyone, despite the 250-employee exemption), which details Art. 30 GDPR requires, which retention periods determine the deletion periods and how to link the two so that they work in everyday business.
Read more →
A data processing agreement is mandatory as soon as a service provider processes personal data on your behalf: hosting, cloud, newsletters, CRM. With tax advisers, lawyers or banks, on the other hand, you don’t need one. This guide explains how to tell the difference, the mandatory contents under Art. 28 GDPR, how to deal with sub-processors and US providers, and how to check a provider’s DPA in ten minutes.
Read more →
Technical and organisational measures (TOM) are the part of the GDPR that decides over fines and data breaches. This guide explains the requirements of Art. 32 GDPR, the classic TOM catalogue with examples, how to rate your protection needs, which measures are realistic for a company of ten people and how to build the TOM document that authorities and clients want to see.
Read more →
Every website needs a privacy policy, because even loading a page processes personal data. This guide shows which information Art. 13 GDPR requires, how to describe services such as analytics, newsletters or Google Fonts correctly, what the TDDDG means for cookies and which mistakes most often lead to cease-and-desist letters.
Read more →