Data protection

Data protection refers to the protection of personal data and documents against misuse due to perusal, alteration, or exploitation to the detriment of the protectable interest of the affected party.

A corresponding data protection system must be set up to protect this data and thus the personal rights of the affected party. For this reason, non-public organizations that deploy automated processes to process personal data and permanently employ at least twenty employees as a rule are required to appoint in writing an officer for data protection no later than one month following the assumption of their tasks pursuant to section 4f German Federal Data Protection Act (BDSG).

Other laws, such as

• the respective regional data protection legislation,
• ecclesiastical requirements under data protection law, and
  • the "Ordinance on Ecclesiastical Data Protection" (KDO) in conjunction with the “Ordinance on the Execution of the Ordinance on Ecclesiastical Data Protection” (KDO-DVO) or
  • the Ecclesiastical Act on Data Protection of the Protestant Church in Germany (DSG-EKD), or
• provisions under special legislation, usually specific to a profession or sector, such as
  • in hospitals/healthcare facilities,
  • in legal practices,
  • in accountants’ or auditors’ practices,

also place (high) demands on data protection.

The failure to set up a corresponding data protection system or any delay in appointing a data-protection officer represents an administrative offence and may be prosecuted with a fine. Additionally, the reputation of the company is at risk if any breach of data protection provisions becomes public.

IT AUDIT enhances compliance with data protection stipulations in the company by providing expert advice. IT AUDIT is able to offer the following services in its role as an external data protection officer or in the form of coaching, in each case tailored to the specific sector and individual needs of the company:

• Creation of a data protection concept and set-up of the data protection system
• Creation of a data protection manual and catalogue of processes
• Performance of a data protection audit (based on section 9a BDSG) and/or data protection inspections
• Training and information of the employees