Within Europe, under the GDPR, appointing a Data Protection Officer (DPO) becomes mandatory when an organization processes sensitive data on a large scale or systematically monitors individuals. In Germany, the Federal Data Protection Act (BDSG) sets an additional threshold: companies with 20 or more employees regularly handling personal data must appoint a DPO. There’s also an obligation if the company is required to conduct a Data Protection Impact Assessment (DPIA) — for example, in high-risk processing activities.

AI often involves extensive data processing — sometimes including sensitive or large-scale data sets. This raises questions of legal basis, transparency, data minimization, and automated decision-making under the GDPR. Companies should also be aware of emerging regulations such as the EU AI Act. Because every AI use case is different, a tailored risk assessment is crucial. We help organizations identify risks, structure compliance, and use AI responsibly — without limiting innovation.

Yes — GDPR applies to every company processing personal data of EU citizens, regardless of size. While supervisory authorities may prioritize larger cases, SMEs are frequently fined for insufficient privacy notices, weak security, or missing contracts with processors. In fact, SMEs often benefit most from external data protection support: practical, scalable solutions help them stay compliant without losing agility.