Офис защиты данных

Data protection is rarely hard because a single document is complicated. It is a slog because so many pieces interlock: the privacy policy references your processors, the processors need a data processing agreement, the DPA assumes technical and organisational measures, and your records of processing have to reflect all of it cleanly. The Privacy Office lays these eleven tools side by side so you stop jumping between eleven tabs and three templates.

It starts with the statements. The privacy policy generator builds your policy block by block: contact form, hosting, analytics, newsletter, social media. The cookie policy generator produces the matching cookie table with purpose, provider and lifetime, and the GDPR cookie banner delivers a consent banner with real opt-in that only loads once the visitor has actually agreed. Three tools, one coherent set of texts for your website.

As soon as external processors are involved, you need contracts. The DPA generator creates a data processing agreement under Art. 28 GDPR that you present to your processors or have them countersign. Alongside it, the TOMs generator documents your technical and organisational measures - access control, encryption, permissions and backups - in a structure a supervisory authority recognises immediately.

The heart of any GDPR documentation is the records of processing activities under Art. 30. The Art. 30 helper walks you through it processing by processing: purpose, legal basis, categories of data subjects, recipients, deletion deadlines. The purpose library hands you ready-worded purposes and matching legal bases that you add to the register with one click, and the workspace keeps every processor with its DPA status in one place, so you can see at a glance where a contract is still missing.

Where risk is involved, the data protection impact assessment comes into play. The DPIA quick check asks you a few short questions about whether your processing is likely to carry a high risk and therefore requires a full assessment under Art. 35. Not a legal opinion, but an honest traffic light that tells you whether you need to look more closely.

At the end comes deletion, and that is exactly what gets forgotten most often. The deletion concept generator sets out when which data is deleted, with the statutory retention periods per data type. The retention planner keeps the concrete deletion dates in view and adds them to the Fristenwächter, from eight years for invoices to the prompt deletion of a rejected job application. Together they make sure data does not linger forever just because nobody thought about it.

Honest about the technology: some tools run on our server, for example the text blocks of the privacy policy. Your Art. 30 register and your retention dates are stored in your account so they are not lost when you sign out. The individual tools stay reachable on their own; the office is just the shared workbench on top. So you can always open a single tool without needing the whole suite.

And the honest note up front: the Privacy Office does not replace legal advice. It takes the dull grind off your plate and gives you seriously good groundwork, but for tricky cases, international data transfers or special categories of personal data, get a look from a lawyer or your data protection officer. We are on your side, not your liability shield.