Search
Contact
04.07.2017 | KPMG Law Insights

There is no turning back. The new GDPR applies. – Tightening of European data protection: the countdown is on!

Tightening of European data protection: the countdown is on!

Only 20 months remain until the General Data Protection Regulation (GDPR) applies. Companies must take action now at the latest in order to adapt their processes in good time.

The comprehensive digitization of large parts of social life has led to a massive increase in the importance of data protection law in recent years. Increasingly, the competition for customers is being won by companies that are smart in their use of data. Companies without an effective data protection organization tend to lose out in the increasingly digital economy.

German data protection law as a model

With the GDPR, the data protection requirements for companies are once again significantly tightened. The already high level of data protection in Germany was the model for the new European legal framework in many respects. In part, therefore, the General Data Protection Regulation merely specifies and concretizes the requirements that must already be observed under German data protection law. The data subject’s right to information, the obligation to appoint a company data protection officer, the procedure directory or notification obligations in the event of data protection violations should already be well known in German companies.

New framework conditions

However, the GDPR also introduces new requirements. For example, the position of the company data protection officer is strengthened considerably by the GDPR. He must no longer merely work towards compliance with data protection requirements, but must also actively monitor them. This growing responsibility is accompanied by painful sanctions: the GDPR expands the previous fine framework for data protection violations to up to EUR 20 million or up to 4% of the annual global revenue generated in the previous fiscal year. At the same time, however, data protection pitfalls are not diminishing as networking continues. Data protection liability risks will therefore increase significantly with the GDPR.

At a glance

  • The GDPR applies directly across Europe as of May 25, 2018, without the need for an implementing law.
  • The GDPR standardizes European data protection law at a high level and creates a new framework for handling personal data.
  • Data protection violations will be severely punished and more strictly prosecuted on the basis of the GDPR.
  • Many companies misjudge the effort required to convert their processes and are not aware of the demands placed on them.
  • With our consulting services, we minimize legal risks and support you in overcoming data protection challenges.

Lack of preparation despite high sanction risks

In view of such sanction risks, the hesitant preparation of companies that can currently be observed can be fatal. Current studies show that only a single-digit percentage of companies have developed concrete plans to implement the new European legal requirements. The data protection authorities have already indicated to us that their hitherto predominantly cooperative approach will no longer be sustainable at the pan-European level. It is likely that sanctions will be imposed far more frequently and will be significantly higher. This is already the case in other European countries.

Become active now

Those who still believe they can take their time preparing for the GDPR are underestimating the implementation effort involved. Experience shows that in many companies there is already little clarity about the type and scope of existing data processing structures. However, the GDPR demands precisely this transparency and also IT security, for example by strengthening the data subject’s rights to information and forcing companies to conduct detailed data protection impact assessments.

Standard processes are also affected: Consent under data protection law, which has already been difficult to formulate, must soon provide even clearer information about the purposes of data collection and processing in order to be effective. Finally, the idea of “privacy by design” has been elevated to a guiding principle, meaning that companies are required to protect data through technology design and data protection-friendly default settings. So companies don’t have much time left to overcome these numerous technical and organizational challenges. We are happy to support you!

Services of KPMG Law

Our team of highly specialized lawyers provides comprehensive advice to international and national corporations, small and medium-sized enterprises, public corporations, as well as financial investors and start-ups in the area of information management (data protection and IT security), in particular in the identification, analysis and evaluation of existing legal documentation and internal processes for handling personal data (“Privacy Impairment Check.) as well as their optimization.

In addition, we provide creative advice on the introduction of information and data management in compliance with data protection requirements and on the development and market launch of products (“Privacy by Design”).

Of course, we also advise you on an ad hoc basis in internal or external investigation proceedings, e.g. following a “data loss incident” in the event of a crisis, and represent you in all official or court proceedings (legal representation). Feel free to contact us at any time about our consulting services!

 

Explore #more

09.07.2025 | KPMG Law Insights

Restructuring with staff reductions: preparation is key

The downsizing or closure of a part of a company often also necessitates staff reductions. Depending on the number of employees affected, the works council…

08.07.2025 | Deal Notifications

KPMG Law advises Finish Finnfoam Group on the acquisition of the Phonotherm business of insolvent BOSIG Baukunststoffe GmbH

KPMG Law advised Finnfoam Group (Salo/Finland) on the acquisition of the business unit “Phonotherm” from BOSIG Baukunststoffe GmbH via the newly founded Warmotech GmbH as…

07.07.2025 | Deal Notifications

KPMG Law advises HEMRO International AG on the acquisition of Xenia Espresso GmbH

KPMG Law Rechtsanwaltsgesellschaft mbH (KPMG Law) provided legal advice to HEMRO Group, a global manufacturer of coffee grinders and grinding technologies headquartered in Zurich, Switzerland,…

04.07.2025 | KPMG Law Insights

BGH clarifies the limits of the definition of customer installations

On July 3, 2025, the BGH published the reasons for its ruling of May 13, 2025 (case no. EnVR 83/20) and provided the eagerly awaited…

02.07.2025 | In the media

Guest article by Moritz Püstow on the special fund for infrastructure

The German government wants to invest 500 billion euros in infrastructure and climate neutrality. This creates new business opportunities for the construction industry – but…

01.07.2025 | Deal Notifications

KPMG Law advised Bosch on the multinational carve-out of the entire product business of Bosch Building Technologies to investor Triton

KPMG Law advises Robert Bosch on the carve-out of the building technologies division’s product business for security and communications technology (Bosch Building Technologies) in more…

27.06.2025 | KPMG Law Insights

Hospital restructuring: three steps out of the crisis

Many clinics see their existence threatened in the short or medium term. Other healthcare facilities are also experiencing economic difficulties. Inadequate remuneration structures, staff shortages,…

27.06.2025 | In the media

KPMG Law nominated at the PMN Awards

We are delighted to have been nominated directly in two categories at the PMN Awards 2025. Our “Extended Workbench” project was nominated in the…

25.06.2025 | KPMG Law Insights

Business Travel and Assignment in the USA: What you need to know about US immigration

The recent changes in US immigration rules are causing uncertainty worldwide. In particular, since the new US government took office, processes regarding entry into the…

11.06.2025 | KPMG Law Insights

Omnibus IV brings some simplifications, especially in product law

The EU Commission proposed the fourth omnibus package on May 21, 2025. Omnibus IV contains simplifications in relation to numerous product law requirements and…

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.

Scroll