Data protection!

Tightened since May 2018

Especially in small companies, nobody likes to take time for the required data protection documentation and training. But even with a website or customer mailings, knowledge of the GDPR is essential and must be complied with.

I need your help!

Corporate Data Protection

Advice on the collection, processing and use of personal data

Data protection is often lumped together with data security. However, data protection is aimed exclusively at the collection, processing and use of personal data. Of course, this also places demands on data security, so the transition is often fluid. Legal obligations have existed since May 25, 2018 based on the EU General Data Protection Regulation (EU-GDPR).


The correct handling of personal data under data protection law is a MUST for EVERY entrepreneur, regardless of whether he is now is obliged to appoint an internal or external company data protection officer due to the number of employees who handle personal data (from 20 employees; in Germany since November 26, 2019) or his area of activity. Particular attention must be paid to the collection, storage, use and deletion of personal data! For example, when sending newsletters to customers and prospects of a company as well as when using video cameras to monitor entrance and work areas.


In my opinion, it is particularly important to develop an understanding of data protection in the company. Apart from the formal implementation (documentation of the processing operations, contracts for order data processing, training of employees, etc.), it is not enough to be able to present THE data protection officer. The entire workforce MUST understand what data protection is basically about and where the company or organization - i.e. a group of people - runs the risk of disregarding the GDPR rules of the game. How quickly do you seemingly simply open the door for someone in a friendly manner? Social engineering is the method by which cybercriminals often gain access to data far too quickly. Ultimately, the management remains responsible! Make your employees a human firewall.


A "data breach", i.e. the disclosure of personal data to third parties, must be reported to the relevant supervisory authority within 72 hours and communicated to those affected. Are you prepared for this in your company - also during the Christmas holidays ?!

I have to speak to you!

Consulting services data protection

  • Creation of guidelines on data protection (security policy)
  • Advice and support in the planning and implementation of measures that are subject to prior inspection
  • Development of public and internal procedures directories
  • Consulting in the planning and implementation of technical and organizational measures
  • Consultation in advance of data protection audits by the supervisory authority
  • Accompaniment of data protection audits by the supervisory authority
  • Data protection courses , independent data protection officer

Certificate of data protection

Data protection certificate - valid until July 2022

  • Legal foundations of data protection
  • Company data protection officers in practice
  • IT security and data protection: Technical-organizational measures
  • Dealing with the supervisory authorities
  • Obligation to maintain data secrecy "Internal procedure directory" / "Public procedure directory" 
  • Support from company management and specialist departments

Cooperations with qualified data protection partners

Data protection goes hand in hand with data security, because it does not work without organizational and IT-technical processes and specifications. That is why I enjoy working with my selected partners in a trusting manner in this context.


Gruber Security Consultancy

  • Certified as Chief Information Security Officer CISO
  • Certified as ISMS specialist & ISO 27000 lead auditor
  • Certified as specialist for data protection


Helpful information about data protection

I am happy to provide you with some information here to help you implement the data protection requirements. Nevertheless, the work remains to be done and the effort should not be underestimated. In my experience, companies that have implemented a quality management system according to ISO 9001 find it much easier to implement. But this certificate is not a prerequisite, on the contrary: compliance with the GDPR applies to every company.

IHK Munich | Training and lots of information

The Chamber of Commerce and Industry for Munich and Upper Bavaria (IHK Munich for short) offers good training on data protection. It also provides a lot of information and tips for entrepreneurs online - on their website as well as in online lectures - and also on data protection.

That is why I am happy to provide you with the IHK's most important link: >> www.ihk-muenchen.de/de/Service/Recht-und-Steuern/Datenschutz

Bavarian State Office for Data Protection Supervision | Checklists, messages

The Bavarian State Office for Data Protection Supervision, based in Ansbach (short: LDA Bayern), is available to the data protection officer with advice and action. But it also checks whether and to what extent companies are implementing the requirements of the GDPR and imposes considerable penalties. Here, too, there are many checklists and templates that support the implementation of data protection. Click here for the Bavarian data protection universe: >> www.lda.bayern.de 
Further important links:

Frequently asked questions about data protection and data security

You have a question? I like to provide answers or I know someone who knows more.

  • Is it dangerous to save passwords in the browser?

    As soon as hackers gain access to your computer, they can also steal the usernames and passwords for all accounts stored in browsers. And because unfortunately more than half of the employees use the same password for work and private accounts, the risk of credential theft and account transfer is high!

  • What does social engineering mean?

    Social engineering means that hackers gain access to your IT world by psychologically and verbally very cleverly questioning employees. It sounds so simple and you may not believe that it can work in your own company, but the "break-in" always succeeds.

  • Can the email address of your domain be faked?

    Domain spoofing is when hackers send emails with your sender. The recipients, who you may know, not only unsuspectingly open the e-mail, but also click on links that were fatally contained. This opens the door to phishing.

    The Berlin-based company KnowBe4 offers a free domain spoofing test.