Question 1

Who needs technical and organisational measures?

Accepted Answer

Anyone handling data needs technical and organisational measures (TOM). Start-ups, sole traders, small businesses, local trades – when personal data is involved, TOM are indispensable. In a digital world: security first, whatever the company size.

Question 2

What must TOM include?

Accepted Answer

Technical and organisational measures (TOM) must comprehensively explain how security of personal data is ensured.

TOM should include:
- the party responsible for implementing and monitoring TOM
- nature and purpose of technical measures (e.g. encryption, firewall)
- nature and purpose of organisational measures (e.g. training, access rights)
- procedures for regular review and updates
- emergency plans in case of data breaches
- measures for physical security of storage locations
- pseudonymisation and anonymisation strategies
- processes for reporting and resolving security incidents
- documentation and logging procedures
- rules on processor processing

TOM must be precise, transparent, and in clear, plain language so staff, external partners, and authorities can understand how data security is ensured.

Question 3

How do I create TOM for my business?

Accepted Answer

Creating technical and organisational measures (TOM) for a business is not trivial; it requires careful planning and ongoing monitoring.

1. Current-state analysis: where do you stand on data security?
2. Risk analysis: what data-related threats exist?
3. Define technical and organisational measures: from encryption to staff training.
4. Documentation: record everything in writing.
5. Implementation: put theory into practice – often challenging.
6. Ongoing monitoring: nothing stays static. Review, adapt, and improve regularly.
7. Use feedback: learn from every incident.

Creating TOM can become a major project requiring detail and persistence. Professional advice can be valuable.

Question 4

How do I create TOM with Dieter?

Accepted Answer

When Dieter creates technical and organisational measures, all required information is collected through simple questions.

You work step by step through questions answerable in most cases with yes or no. For example: Do you offer a newsletter?

Through smart questions and a wide range of predefined services Dieter ensures all mandatory details are included.

No specialist knowledge is required.

The result is a complete document with all necessary details.

TOM can be updated whenever needed. Dieter tracks legal changes and provides the current compliant version.

Question 5

Who may create TOM?

Accepted Answer

We generally recommend having TOM created by an expert. There are no formal requirements as to who may draft them.

Creation requires high accuracy and attention to many factors. You must also follow technological developments to reflect the dynamic service provider landscape adequately in TOM.

Question 6

What happens if I have no TOM?

Accepted Answer

Missing TOM or inadequate TOM can have serious consequences. It is a breach of applicable data protection law (in Germany, the GDPR and notably the BDSG), with fines of up to €20 million or 4% of worldwide annual turnover – whichever is higher.

Question 7

Data protection is a legal requirement

Accepted Answer

All businesses must meet GDPR requirements. That applies regardless of headcount – including sole traders and solo self-employed professionals.

They must comply with general data protection principles (lawfulness, transparency, purpose limitation, data minimisation, among others), inform data subjects about processing, and implement technical and organisational measures to protect personal data. Smaller businesses are also required to maintain a record of processing activities, a deletion concept, and processes for handling personal data breaches, and more.

With Dieter, you no longer need to worry. We take care of everything you need to meet your legal obligations.

Question 8

Cease-and-desist letters are on the rise

Accepted Answer

Cease-and-desist letters for GDPR violations have increased steadily in recent years. A prominent example is the wave of letters over unlawful use of Google Fonts in summer 2022. Although some of those letters were not lawful, they were based on a Munich Regional Court decision from January 2022. In late 2022, the Court of Justice of the EU also ruled that consumer associations may generally send cease-and-desist letters for GDPR breaches. These and other court decisions triggered further waves. EU-wide GDPR fines reached a new record of €1.2 billion in 2024. Any business that neglects its legal duties can be affected.

Question 9

A legally compliant website is essential

Accepted Answer

A GDPR-compliant website is the first step to protect yourself effectively against cease-and-desist letters. In 2022 alone, there were countless letters over unlawful use of Google Fonts – and pressure continues to grow. Since May 2024, the German Digital Services Act (DDG) has also placed further requirements on website operators. Dieter handles your data protection needs and can create your Impressum as well.

Question 10

More fines for small businesses

Accepted Answer

Data protection authorities have begun conducting inspections without a specific trigger. For companies with fewer than 20 employees, the statistical risk of being affected is over 10:1.

Question 11

Cybercrime in Germany is growing sharply

Accepted Answer

According to a Bitkom study, 87% of German companies were recently victims of a cyber attack. Total damage to the German economy exceeds €289 billion per year – and rising. Implementing mandatory technical and organisational measures (TOM) significantly reduces the risk of being affected.

Question 12

Sharing data requires contractual arrangements

Accepted Answer

Almost all German businesses use services from companies (Google, Microsoft, Meta, Amazon, etc.) that require an international data protection agreement (SCC/JC). Digital service providers also necessarily receive personal data from their clients to deliver the service. In those cases, you must assess whether and with whom data processing agreements (DPAs) are required. Dieter handles that assessment and always provides the right contract.

Question 13

Personal data is a form of currency

Accepted Answer

Since 2022, personal data has been legally treated in some respects like a currency – and with the Data Act in force since 2024, data as an economic asset carries even more weight. Awareness is growing. This data should be as secure as a bank account – and implementing the GDPR helps achieve that.

Question 14

Poor data protection costs customers and business partners

Accepted Answer

More than two thirds of participants in a consumer data and privacy study (commissioned by McKinsey & Company) said they would no longer be customers of – or would stop working with – a company that does not protect their data or shares it without a legal basis. Responsible handling of personal data and meeting legal obligations is a clear competitive advantage.

Question 15

The right to data protection is a fundamental right

Accepted Answer

Everyone has the right to decide which personal (and therefore highly private) data about them is collected, stored, and used. It also helps prevent misuse, fraud, and discrimination. Data protection protects privacy, identity, and freedom – and is essential for a democratic society. Respecting it should be a matter of course for every business.

Question 16

What are TOM?

Accepted Answer

TOM stands for technical and organisational measures implemented in a business to protect customer data. They are required by Art. 32 GDPR to ensure personal data is processed with adequate protection. If you need support creating TOM, rely on Dieter Datenschutz. Our software generates the relevant content in minutes so you can meet GDPR requirements.

Question 17

Easy to use and innovative features

Accepted Answer

Dieter Datenschutz balances simple, intuitive handling so you can use the full feature set with innovative functionality. You can rely on TOM created with Dieter Datenschutz to include all mandatory legal content. Create measures online with a few inputs and download them directly.

Question 18

What makes Dieter Datenschutz stand out?

Accepted Answer

Dieter Datenschutz is a flexible software solution developed specifically for businesses, freelancers, and solo self-employed professionals. From the outset the focus was enabling SMEs to meet high data protection requirements without being overwhelmed by cost. Dieter Datenschutz now serves more than 5,000 satisfied users and has helped create over 15,000 legal documents. More than 500 services are available to use flexibly. Try Dieter Datenschutz with no obligation.

Create TOM documentation

Your TOM created in minutes

Essentials: your technical and organisational measures

Why TOM under Art. 32 GDPR matter

Create your TOM in minutes

Ein Blick in unsere All-in-One Datenschutz Software

Datenschutzerklärung mit ein paar Klicks erstellt

Frequently asked questions about TOMs

What our
customers say

"Data protection can be this simple!"

"A huge relief when starting out as self-employed!"

"The perfect solution for data protection!"

"Outstanding service with direct 1:1 support"

"Dieter is simply brilliant—from the questionnaire style to support."

"A wonderful tool for all data protection needs"

Die Menschen hinter Dieter

Schützen Sie sich jetzt und aktiv

TOM erstellen: technische und organisatorische Maßnahmen belastbar dokumentieren

Welche Struktur ein professionelles TOM-Dokument haben sollte

TOM nicht isoliert führen, sondern mit AVV und Verzeichnis koppeln

Kostenloser Check-up

Individuelle Anforderungen?

KI nutzen. Rechtssicher.