Symbolbild zu Data Compliance Management: Frau tippt auf Tablet
15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”


The third part of this series of articles deals with data compliance management. Once a company has created a solid foundation in data categorization and developed an understanding of the data lifecycle, the question arises: How can practical implementation succeed?

Strategic orientation of data compliance management

To begin with, companies should define the strategic direction of data compliance management. This should be in line with the overarching corporate objectives and the specific compliance requirements. The corporate culture should recognize the value of data protection and compliance. For example, a financial services company could develop a strategy that aims to ensure compliance with GDPR and local data protection laws while providing innovative financial products. In any case, it is important that the strategy pursues clear, measurable and, above all, realistically achievable goals.

Tools and technologies for data compliance management

Companies need suitable tools and technologies to manage data efficiently. For example, data governance platforms can help to maintain an overview of the data landscape. Data protection management systems support compliance with data protection regulations. It is essential that no shadow structures are created wherever possible. It can therefore make sense to fall back on existing structures, even if they may not offer all the desired functionalities. The additional cost of implementing and networking a new solution should be carefully weighed up in these cases.

Cross-functional collaboration

When introducing data compliance management, close cooperation between legal, technical and operational teams is recommended. For example, an interdisciplinary team of legal, IT and compliance experts could be formed to develop a coherent strategy to meet the requirements of the legal requirements. The complexities in the area of data compliance are sometimes so pronounced that a specialist department alone may have difficulties keeping track of everything. Teamwork is the key to success.

Employees should be trained and sensitized

Companies should regularly train their employees in order to promote compliance-friendly behavior within the company. However, data protection training should not be the only measure, but should be supplemented by sensible awareness-raising measures and supported by management through words and deeds.

Outsourcing of data compliance management via managed services

It can make sense to hand over key operational parts of data compliance management to specialized providers that use Legal Managed Services (LMS). When selecting and engaging such a service provider, it is important to establish clear handover interfaces, defined roles and responsibilities as well as binding service level agreements (SLAs). These elements ensure that both the company and the service provider clearly understand the expectations and obligations.

Measurement and continuous improvement

Once data compliance management has been established, companies should monitor performance. To this end, they should develop maturity levels and key figures and present them clearly in the form of dashboards. Key figures are suitable, for example, for monitoring compliance with retention periods or for handling data leaks. Companies should also develop strategies for dealing with data breaches and other compliance issues. A central element of such a strategy is a well-thought-out incident response plan.


The practical implementation of data compliance management is an iterative process that requires strategic alignment, operational excellence and continuous improvement. With a well thought-out approach, companies can achieve their compliance goals and ensure sustainable data protection.


Explore #more

27.03.2024 | KPMG Law Insights

EU Buildings Directive: life cycle greenhouse potential becomes relevant

On March 12, 2024, the EU Parliament approved the amendment to the EU Buildings Directive. The directive obliges member states and, indirectly, building owners and…

19.03.2024 | Business Performance & Resilience, KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

The EU member states agreed on the CSDDD, the EU Supply Chain Directive, on March 15, 2024. Germany abstained from the vote. Negotiators from the…

19.03.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

14.02.2024 | Business Performance & Resilience, PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…

09.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: The employment law function

In almost all German companies, the employment law function is located in the HR department and not in the legal department. One of the reasons…

24.01.2024 | KPMG Law Insights

How the new unitary patent works – ten facts

The new unitary patent can be applied for at the European Patent Office (EPO) from June 1, 2023. The Implementing Regulations and the Schedule of

22.01.2024 | PR Publications

Guest article in the Börsen-Zeitung on the subject of EU antitrust regulations

Agreements with competitors on sustainability efforts may violate antitrust law. Which legal interest should then take precedence? KPMG Law expert Jonas Brueckner discusses this question…

18.01.2024 | KPMG Law Insights

AI and copyright – what is permitted when using LLMs?

A few months ago, new players entered the legal scene and have since caused numerous legal discussions: Large Language Models (LLM), better known as…

17.01.2024 | PR Publications

Geopolitical challenges mean new tasks for legal departments

Dealing with geopolitical and geo-economic risks entails many new tasks for the legal department and even changes its fundamental role. More and more, it is…


Dr. Jyn Schultze-Melling, LL.M.


Heidestraße 58
10557 Berlin

tel: +49 30 530199 410

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.