Data Protection Consulting: Turning the GDPR Into Processes That Hold in Daily Work

Data protection consulting orders the processing of personal data in a company along three questions: what was the data collected for, what does the processing rest on, and when does it end. In practice that means: recording processing activities the way they actually run; naming a legal basis for each one; setting retention and erasure as a period per data category; regulating processors and transfers outside the EU; assigning technical and organisational measures to the risk; and clarifying early for new plans whether a data protection impact assessment is required. The result is not folders but processes, system settings and contracts that hold up to the requirements in daily work.

The duty to appoint follows from the Regulation and, in Germany, additionally from the Federal Data Protection Act. It applies among other things where at least 20 people are permanently occupied with the automated processing of personal data, where processing activities are subject to a data protection impact assessment, or where data is processed commercially for transmission, for anonymised transmission, or for market and opinion research. Public authorities are obliged as a matter of principle. More important than the headcount threshold in practice is the question of compatibility: whoever is responsible for the processing itself — head of IT, head of HR, managing director — must not also monitor it. That is the most common reason to fill the role with an external data protection officer.

Pursuant to Article 30 for each processing operation: the name and contact information of the controller and, if appointed, the data protection officer; the purpose of the processing; the categories of data subjects and the types of data; the recipients to whom the data is disclosed, including processors; transfers to third countries, including the legal basis; the intended retention periods; and a description of the technical and organisational measures. In practice, it is also worthwhile to maintain a record of the systems used and the legal basis for each processing activity — neither of which is explicitly required by law, but both are needed during any audit. It is crucial that the record describes the actual process as it is carried out: if it deviates from this, it is not evidence but rather a dated contradiction.

Where a processing activity is likely to bring a high risk to the rights and freedoms of data subjects. Article 35 names three standard cases: extensive evaluation of personal aspects including profiling as the basis for automated decisions, extensive processing of special categories such as health data, and systematic extensive monitoring of publicly accessible areas. Beyond that, the supervisory authorities keep lists of processing activities for which they require a DPIA. It is worth doing early in the design: then it shapes data fields, access and retention, instead of assessing a decision that has already been taken.

Data security addresses who has access to data and how it is protected against loss and unauthorised access — encryption, access permissions, attack detection, and fault tolerance. Data protection, on the other hand, asks beforehand whether the data is even permitted to exist: for what purpose it was collected, on what legal basis it is processed, and when it must be deleted. The two are intertwined, because the technical and organisational measures under Article 32 are security measures designed to support data protection. But they are not interchangeable: a perfectly encrypted dataset without a legal basis remains unlawful, and a sound legal basis does not protect an unsecured server.

Billing is by daily rate. For the Compliance & Legal area, the ranges stated on our role pages currently run between €750 and €1,600 per day, framed more narrowly per role — an external data protection officer, for instance, between €800 and €1,400. How many days a project needs does not hang on the headcount but on the number of business units and systems, the state of the existing papers, and whether special categories or third-country transfers are in play. A baseline assessment is far smaller than building complete records of processing activities; an appointment under Article 37 does not run through a project budget but through an annual allowance.

On five variables. First, seniority and audit experience — somebody who has accompanied several supervisory procedures is rated differently from somebody with a certificate and little practice. Second, the orientation: legal assessment, technical implementation, or both. Third, the sector with its additional rules, such as state hospital legislation, financial supervision or sector-specific public law. Fourth, the language requirement, as soon as several national subsidiaries with their own national data protection law come in. And fifth, the role: an appointment with external standing towards the supervisory authority carries more responsibility than a contribution to a baseline assessment, and is placed accordingly.

That hangs on the cut, but the order in which the effect appears is stable. Effect shows first where a deadline runs: a practised procedure for access and erasure requests and a working notification route for personal data breaches are quickly established and immediately measurable against the number of deadlines met. After that the baseline takes effect, because it ends the argument inside the company. The implementation into systems takes longest — erasure routines and authorisation models hang on release cycles and on applications that never provided for erasure. Success is measured against checkable figures: the share of processing activities with a named legal basis and retention period, the share of providers with a complete contract and an assessed transfer, deadlines met on data subject requests, and client questionnaires or audits passed.