04.07.2017 | KPMG Law Insights

There is no turning back. The new GDPR applies. – Tightening of European data protection: the countdown is on!

Tightening of European data protection: the countdown is on!

Only 20 months remain until the General Data Protection Regulation (GDPR) applies. Companies must take action now at the latest in order to adapt their processes in good time.

The comprehensive digitization of large parts of social life has led to a massive increase in the importance of data protection law in recent years. Increasingly, the competition for customers is being won by companies that are smart in their use of data. Companies without an effective data protection organization tend to lose out in the increasingly digital economy.

German data protection law as a model

With the GDPR, the data protection requirements for companies are once again significantly tightened. The already high level of data protection in Germany was the model for the new European legal framework in many respects. In part, therefore, the General Data Protection Regulation merely specifies and concretizes the requirements that must already be observed under German data protection law. The data subject’s right to information, the obligation to appoint a company data protection officer, the procedure directory or notification obligations in the event of data protection violations should already be well known in German companies.

New framework conditions

However, the GDPR also introduces new requirements. For example, the position of the company data protection officer is strengthened considerably by the GDPR. He must no longer merely work towards compliance with data protection requirements, but must also actively monitor them. This growing responsibility is accompanied by painful sanctions: the GDPR expands the previous fine framework for data protection violations to up to EUR 20 million or up to 4% of the annual global revenue generated in the previous fiscal year. At the same time, however, data protection pitfalls are not diminishing as networking continues. Data protection liability risks will therefore increase significantly with the GDPR.

At a glance

  • The GDPR applies directly across Europe as of May 25, 2018, without the need for an implementing law.
  • The GDPR standardizes European data protection law at a high level and creates a new framework for handling personal data.
  • Data protection violations will be severely punished and more strictly prosecuted on the basis of the GDPR.
  • Many companies misjudge the effort required to convert their processes and are not aware of the demands placed on them.
  • With our consulting services, we minimize legal risks and support you in overcoming data protection challenges.

Lack of preparation despite high sanction risks

In view of such sanction risks, the hesitant preparation of companies that can currently be observed can be fatal. Current studies show that only a single-digit percentage of companies have developed concrete plans to implement the new European legal requirements. The data protection authorities have already indicated to us that their hitherto predominantly cooperative approach will no longer be sustainable at the pan-European level. It is likely that sanctions will be imposed far more frequently and will be significantly higher. This is already the case in other European countries.

Become active now

Those who still believe they can take their time preparing for the GDPR are underestimating the implementation effort involved. Experience shows that in many companies there is already little clarity about the type and scope of existing data processing structures. However, the GDPR demands precisely this transparency and also IT security, for example by strengthening the data subject’s rights to information and forcing companies to conduct detailed data protection impact assessments.

Standard processes are also affected: Consent under data protection law, which has already been difficult to formulate, must soon provide even clearer information about the purposes of data collection and processing in order to be effective. Finally, the idea of “privacy by design” has been elevated to a guiding principle, meaning that companies are required to protect data through technology design and data protection-friendly default settings. So companies don’t have much time left to overcome these numerous technical and organizational challenges. We are happy to support you!

Services of KPMG Law

Our team of highly specialized lawyers provides comprehensive advice to international and national corporations, small and medium-sized enterprises, public corporations, as well as financial investors and start-ups in the area of information management (data protection and IT security), in particular in the identification, analysis and evaluation of existing legal documentation and internal processes for handling personal data (“Privacy Impairment Check.) as well as their optimization.

In addition, we provide creative advice on the introduction of information and data management in compliance with data protection requirements and on the development and market launch of products (“Privacy by Design”).

Of course, we also advise you on an ad hoc basis in internal or external investigation proceedings, e.g. following a “data loss incident” in the event of a crisis, and represent you in all official or court proceedings (legal representation). Feel free to contact us at any time about our consulting services!


Explore #more

08.12.2023 | PR Publications

Payout can be risky

In the current issue of Personalwirtschaft from 30.11.2023, there is a guest article by Stefan Middendorf and Gracjan Modrzyk. Some companies are once again…

07.12.2023 | PR Publications

Institutional Money – It’s all in the mix

Institutional Money 04/2023 discusses the opportunities offered by the Neighborhood Fund. The fund is ideal for real estate investors, as it is not limited to

01.12.2023 | PR Publications

WiWo: Best of Legal Awards – Philipp Glock Leader of the Year

On Thursday evening, WirtschaftsWoche honored outstanding projects and minds from consulting firms and law firms in Düsseldorf and celebrated the second Best of Professional Night…

29.11.2023 | KPMG Law Insights

Energy transition also opens up business opportunities

The energy industry’s complex, capital-intensive transformation process offers investors and banks a great deal of potential By Lars Christian Mahler and Marc Goldberg for Börsen-Zeitung,…

29.11.2023 | KPMG Law Insights

Guest article in ZURe – AI and the legal department of tomorrow

The current issue of ZURe (p. 48 ff.) contains a guest article by KPMG Partner Sina Steidel-Küster (Regional Director Southwest, Head of Stuttgart office) and…

29.11.2023 | KPMG Law Insights, KPMG Law Insights

Key Facts about the new draft of the “Data Act

On February 23, 2022, the EU Commission presented the new draft of the so-called Data Act, the “Regulation on harmonized rules for fair access to…

21.11.2023 |

Guest article in ZURe on the implementation of CSRD reporting in SMEs

The current issue of ZURe (p. 34 ff.) contains a guest article by Lena Plato (Director Legal & Compliance, FLABEG Automotive Group GmbH), KPMG Law…

20.11.2023 | Press releases

Statement by KPMG Law experts in Handelsblatt on the topic of sustainability cooperation in antitrust law

In the Handelsblatt, KPMG Law expert Jonas Brueckner is quoted in detail on the subject of cooperation in terms of sustainability. Until this summer, there…

15.11.2023 |

Legal 500 – Country Comparative Guide Germany

Gerrit Rixen and Jonas Brueckner provide an overview of the relevant legal regulations in the area of Competition & Litigation in a practical guide on…

14.11.2023 | Press releases

Tax and Law at a glance – New issue of the digital magazine “Talk

“Talk” stands for Tax and Law Compass, because that’s what the digital magazine wants to be: a navigation aid to the legal and tax aspects…

© 2023 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.