04.07.2017 | KPMG Law Insights

There is no turning back. The new GDPR applies. – Tightening of European data protection: the countdown is on!

Tightening of European data protection: the countdown is on!

Only 20 months remain until the General Data Protection Regulation (GDPR) applies. Companies must take action now at the latest in order to adapt their processes in good time.

The comprehensive digitization of large parts of social life has led to a massive increase in the importance of data protection law in recent years. Increasingly, the competition for customers is being won by companies that are smart in their use of data. Companies without an effective data protection organization tend to lose out in the increasingly digital economy.

German data protection law as a model

With the GDPR, the data protection requirements for companies are once again significantly tightened. The already high level of data protection in Germany was the model for the new European legal framework in many respects. In part, therefore, the General Data Protection Regulation merely specifies and concretizes the requirements that must already be observed under German data protection law. The data subject’s right to information, the obligation to appoint a company data protection officer, the procedure directory or notification obligations in the event of data protection violations should already be well known in German companies.

New framework conditions

However, the GDPR also introduces new requirements. For example, the position of the company data protection officer is strengthened considerably by the GDPR. He must no longer merely work towards compliance with data protection requirements, but must also actively monitor them. This growing responsibility is accompanied by painful sanctions: the GDPR expands the previous fine framework for data protection violations to up to EUR 20 million or up to 4% of the annual global revenue generated in the previous fiscal year. At the same time, however, data protection pitfalls are not diminishing as networking continues. Data protection liability risks will therefore increase significantly with the GDPR.

At a glance

  • The GDPR applies directly across Europe as of May 25, 2018, without the need for an implementing law.
  • The GDPR standardizes European data protection law at a high level and creates a new framework for handling personal data.
  • Data protection violations will be severely punished and more strictly prosecuted on the basis of the GDPR.
  • Many companies misjudge the effort required to convert their processes and are not aware of the demands placed on them.
  • With our consulting services, we minimize legal risks and support you in overcoming data protection challenges.

Lack of preparation despite high sanction risks

In view of such sanction risks, the hesitant preparation of companies that can currently be observed can be fatal. Current studies show that only a single-digit percentage of companies have developed concrete plans to implement the new European legal requirements. The data protection authorities have already indicated to us that their hitherto predominantly cooperative approach will no longer be sustainable at the pan-European level. It is likely that sanctions will be imposed far more frequently and will be significantly higher. This is already the case in other European countries.

Become active now

Those who still believe they can take their time preparing for the GDPR are underestimating the implementation effort involved. Experience shows that in many companies there is already little clarity about the type and scope of existing data processing structures. However, the GDPR demands precisely this transparency and also IT security, for example by strengthening the data subject’s rights to information and forcing companies to conduct detailed data protection impact assessments.

Standard processes are also affected: Consent under data protection law, which has already been difficult to formulate, must soon provide even clearer information about the purposes of data collection and processing in order to be effective. Finally, the idea of “privacy by design” has been elevated to a guiding principle, meaning that companies are required to protect data through technology design and data protection-friendly default settings. So companies don’t have much time left to overcome these numerous technical and organizational challenges. We are happy to support you!

Services of KPMG Law

Our team of highly specialized lawyers provides comprehensive advice to international and national corporations, small and medium-sized enterprises, public corporations, as well as financial investors and start-ups in the area of information management (data protection and IT security), in particular in the identification, analysis and evaluation of existing legal documentation and internal processes for handling personal data (“Privacy Impairment Check.) as well as their optimization.

In addition, we provide creative advice on the introduction of information and data management in compliance with data protection requirements and on the development and market launch of products (“Privacy by Design”).

Of course, we also advise you on an ad hoc basis in internal or external investigation proceedings, e.g. following a “data loss incident” in the event of a crisis, and represent you in all official or court proceedings (legal representation). Feel free to contact us at any time about our consulting services!


Explore #more

13.06.2024 | Press releases

Handelsblatt and Best Lawyers honor KPMG Law Experts

Best Lawyers has once again identified the best commercial lawyers in Germany for 2024 exclusively for Handelsblatt. A total of 28 lawyers were honored by…

27.05.2024 | KPMG Law Insights

Agreement on ecodesign regulation: products to become more sustainable

After lengthy negotiations, the Council and Parliament of the European Union reached a provisional agreement on the Ecodesign Regulation on the night of December 5,…

22.05.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

17.05.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: When the family business is to be sold

Around 38,000 family businesses are currently handed over each year. In most cases, the change of ownership takes place within the family. But more and…

03.05.2024 | KPMG Law Insights

Doubts about inability to work? What employers can do

The certificate of incapacity for work (AU certificate) serves as proof of incapacity for work due to illness. However, only if the certificate meets certain…

27.03.2024 | KPMG Law Insights

EU Buildings Directive: life cycle greenhouse potential becomes relevant

On March 12, 2024, the EU Parliament approved the amendment to the EU Buildings Directive. The directive obliges member states and, indirectly, building owners and…

19.03.2024 | Business Performance & Resilience, KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

The EU member states agreed on the CSDDD, the EU Supply Chain Directive, on March 15, 2024. Germany abstained from the vote. Negotiators from the…

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | Business Performance & Resilience, PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.