Question 1

When do I need a data protection impact assessment (DPIA)?

Accepted Answer

A DPIA is legally required when planned processing is likely to result in high risk to the rights and freedoms of data subjects (Art. 35 GDPR).

That regularly applies to:
- systematic, large-scale monitoring (e.g. video surveillance, website tracking),
- processing of especially sensitive data (e.g. health or financial data),
- AI and automated systems — e.g. profiling, decision support, behavioural or movement analysis, biometric recognition, and high-risk AI systems under the EU AI Act.

Example:
A fitness start-up offers an app that uses AI to analyse training, health, and location data for personalised recommendations. Data is stored long term and partly shared with third parties (e.g. doctors or insurers).

In that case a DPIA is required because high risk under the GDPR exists: health data is processed, user profiles are created, and AI is used.

Question 2

How must a DPIA be structured?

Accepted Answer

A DPIA must clearly and traceably document what will be processed, what risks may arise for data subjects, and how those risks will be effectively reduced.

Under Art. 35 GDPR a DPIA should include:
- description of the processing and its purposes
- assessment of necessity and proportionality
- analysis of risks to the rights and freedoms of data subjects
- planned remedial measures, safeguards, and protection mechanisms

Concretely: describe the planned processing understandably, systematically analyse likely impacts on rights and freedoms, then present suitable technical and organisational measures to minimise risk – e.g. encryption, access limitation, or pseudonymisation.

Dieter guides you through this process – structured, legally sound, and fully documented.

Question 3

Who needs technical and organisational measures?

Accepted Answer

Anyone handling data needs technical and organisational measures (TOM). Start-ups, sole traders, small businesses, local trades – when personal data is involved, TOM are indispensable. In a digital world: security first, whatever the company size.

Question 4

What must TOM include?

Accepted Answer

Technical and organisational measures (TOM) must comprehensively explain how security of personal data is ensured.

TOM should include:
- the party responsible for implementing and monitoring TOM
- nature and purpose of technical measures (e.g. encryption, firewall)
- nature and purpose of organisational measures (e.g. training, access rights)
- procedures for regular review and updates
- emergency plans in case of data breaches
- measures for physical security of storage locations
- pseudonymisation and anonymisation strategies
- processes for reporting and resolving security incidents
- documentation and logging procedures
- rules on processor processing

TOM must be precise, transparent, and in clear, plain language so staff, external partners, and authorities can understand how data security is ensured.

Question 5

How do I create TOM for my business?

Accepted Answer

Creating technical and organisational measures (TOM) for a business is not trivial; it requires careful planning and ongoing monitoring.

1. Current-state analysis: where do you stand on data security?
2. Risk analysis: what data-related threats exist?
3. Define technical and organisational measures: from encryption to staff training.
4. Documentation: record everything in writing.
5. Implementation: put theory into practice – often challenging.
6. Ongoing monitoring: nothing stays static. Review, adapt, and improve regularly.
7. Use feedback: learn from every incident.

Creating TOM can become a major project requiring detail and persistence. Professional advice can be valuable.

Question 6

How do I create TOM with Dieter?

Accepted Answer

When Dieter creates technical and organisational measures, all required information is collected through simple questions.

You work step by step through questions answerable in most cases with yes or no. For example: Do you offer a newsletter?

Through smart questions and a wide range of predefined services Dieter ensures all mandatory details are included.

No specialist knowledge is required.

The result is a complete document with all necessary details.

TOM can be updated whenever needed. Dieter tracks legal changes and provides the current compliant version.

Question 7

Who may create TOM?

Accepted Answer

We generally recommend having TOM created by an expert. There are no formal requirements as to who may draft them.

Creation requires high accuracy and attention to many factors. You must also follow technological developments to reflect the dynamic service provider landscape adequately in TOM.

Question 8

What happens if I have no TOM?

Accepted Answer

Missing TOM or inadequate TOM can have serious consequences. It is a breach of applicable data protection law (in Germany, the GDPR and notably the BDSG), with fines of up to €20 million or 4% of worldwide annual turnover – whichever is higher.

Question 9

Data protection is a legal requirement

Accepted Answer

All businesses must meet GDPR requirements. That applies regardless of headcount – including sole traders and solo self-employed professionals.

They must comply with general data protection principles (lawfulness, transparency, purpose limitation, data minimisation, among others), inform data subjects about processing, and implement technical and organisational measures to protect personal data. Smaller businesses are also required to maintain a record of processing activities, a deletion concept, and processes for handling personal data breaches, and more.

With Dieter, you no longer need to worry. We take care of everything you need to meet your legal obligations.

Question 10

Cease-and-desist letters are on the rise

Accepted Answer

Cease-and-desist letters for GDPR violations have increased steadily in recent years. A prominent example is the wave of letters over unlawful use of Google Fonts in summer 2022. Although some of those letters were not lawful, they were based on a Munich Regional Court decision from January 2022. In late 2022, the Court of Justice of the EU also ruled that consumer associations may generally send cease-and-desist letters for GDPR breaches. These and other court decisions triggered further waves. EU-wide GDPR fines reached a new record of €1.2 billion in 2024. Any business that neglects its legal duties can be affected.

Question 11

A legally compliant website is essential

Accepted Answer

A GDPR-compliant website is the first step to protect yourself effectively against cease-and-desist letters. In 2022 alone, there were countless letters over unlawful use of Google Fonts – and pressure continues to grow. Since May 2024, the German Digital Services Act (DDG) has also placed further requirements on website operators. Dieter handles your data protection needs and can create your Impressum as well.

Question 12

More fines for small businesses

Accepted Answer

Data protection authorities have begun conducting inspections without a specific trigger. For companies with fewer than 20 employees, the statistical risk of being affected is over 10:1.

Question 13

Cybercrime in Germany is growing sharply

Accepted Answer

According to a Bitkom study, 87% of German companies were recently victims of a cyber attack. Total damage to the German economy exceeds €289 billion per year – and rising. Implementing mandatory technical and organisational measures (TOM) significantly reduces the risk of being affected.

Question 14

Sharing data requires contractual arrangements

Accepted Answer

Almost all German businesses use services from companies (Google, Microsoft, Meta, Amazon, etc.) that require an international data protection agreement (SCC/JC). Digital service providers also necessarily receive personal data from their clients to deliver the service. In those cases, you must assess whether and with whom data processing agreements (DPAs) are required. Dieter handles that assessment and always provides the right contract.

Question 15

Personal data is a form of currency

Accepted Answer

Since 2022, personal data has been legally treated in some respects like a currency – and with the Data Act in force since 2024, data as an economic asset carries even more weight. Awareness is growing. This data should be as secure as a bank account – and implementing the GDPR helps achieve that.

Question 16

Poor data protection costs customers and business partners

Accepted Answer

More than two thirds of participants in a consumer data and privacy study (commissioned by McKinsey & Company) said they would no longer be customers of – or would stop working with – a company that does not protect their data or shares it without a legal basis. Responsible handling of personal data and meeting legal obligations is a clear competitive advantage.

Question 17

The right to data protection is a fundamental right

Accepted Answer

Everyone has the right to decide which personal (and therefore highly private) data about them is collected, stored, and used. It also helps prevent misuse, fraud, and discrimination. Data protection protects privacy, identity, and freedom – and is essential for a democratic society. Respecting it should be a matter of course for every business.

Question 18

What are TOM?

Accepted Answer

TOM stands for technical and organisational measures implemented in a business to protect customer data. They are required by Art. 32 GDPR to ensure personal data is processed with adequate protection. If you need support creating TOM, rely on Dieter Datenschutz. Our software generates the relevant content in minutes so you can meet GDPR requirements.

Question 19

Easy to use and innovative features

Accepted Answer

Dieter Datenschutz balances simple, intuitive handling so you can use the full feature set with innovative functionality. You can rely on TOM created with Dieter Datenschutz to include all mandatory legal content. Create measures online with a few inputs and download them directly.

Question 20

What makes Dieter Datenschutz stand out?

Accepted Answer

Dieter Datenschutz is a flexible software solution developed specifically for businesses, freelancers, and solo self-employed professionals. From the outset the focus was enabling SMEs to meet high data protection requirements without being overwhelmed by cost. Dieter Datenschutz now serves more than 5,000 satisfied users and has helped create over 15,000 legal documents. More than 500 services are available to use flexibly. Try Dieter Datenschutz with no obligation.

Create a DPIA

Your DPIA in clear steps

Essentials: data protection impact assessment

Typical DPIA triggers at a glance

What makes your DPIA robust

How to create one without prior knowledge

Data protection impact assessment: when is a DPIA mandatory?

What a DPIA must include

How to create a DPIA in a structured way

Distinction: DPIA and TOM

When to update an existing DPIA

Create a DPIA with Dieter

Ein Blick in unsere All-in-One Datenschutz Software

Datenschutzerklärung mit ein paar Klicks erstellt

Frequently asked questions about DPIAs

What our
customers say

"Data protection can be this simple!"

"A huge relief when starting out as self-employed!"

"The perfect solution for data protection!"

"Outstanding service with direct 1:1 support"

"Dieter is simply brilliant—from the questionnaire style to support."

"A wonderful tool for all data protection needs"

Die Menschen hinter Dieter

Schützen Sie sich jetzt und aktiv

Datenschutzfolgeabschätzung erstellen: hohe Risiken früh und nachvollziehbar adressieren

DSFA erstellen mit klarer Methodik statt Einzelmeinungen

Warum DSFA, TOM und Betriebsprozesse zusammengeführt werden sollten

Kostenloser Check-up

Individuelle Anforderungen?

KI nutzen. Rechtssicher.