News & Insights

We are your first port of call for the latest news, analysis and background information on data protection, data strategy and IT security. We keep you informed with editorially prepared news and interesting facts. Subscribe directly to our newsletter and never miss a thing again.

13.10.2026

AI governance in organisations: roles, policies and a 90-day plan to get started

AI governance is the full set of rules, processes and structures a company uses to steer its use of AI. It is becoming urgent because business units can now build AI agents themselves, potentially without the knowledge of IT and control functions. We show how to build a robust framework in 90 days.

07.10.2026

Implementing risk management under ISO 27005 in 6 steps

Risk management is at the heart of an effective information security management system (ISMS). ISO/IEC 27005 provides a practical guide for this: flexible, scalable and directly compatible with ISO/IEC 27001. In this article, we show you how to take a structured approach and what benefits this brings to your organisation.

24.09.2026

Privacy by Design: the 10 most important measures

Privacy by Design means that data protection must be part of product, process and IT design from the outset. What matters are clear purposes and data flows, genuine data minimisation with erasure rules, privacy-friendly defaults and workable processes for security, data subject rights and service providers. This article sets out the ten most important measures for lean, auditable implementation.

22.09.2026

Data strategy in 6 steps: from concept to implementation

Companies today generate more data than ever before — but its true value only becomes apparent when data lead to concrete decisions, more efficient processes and new services. This is precisely where a data strategy comes in. However, the real challenge begins after the strategy has been formulated: implementation in day-to-day operations. We show you a pragmatic approach in six steps that can be integrated well into existing structures.

18.09.2026

GDPR Data Protection Audit: Audit-ready in 7 Steps

A data protection audit systematically checks whether your organisation processes personal data in accordance with the GDPR. Whilst the GDPR does not explicitly require such an audit, its obligations regarding evidence and verification make it, in practice, indispensable. We outline the process, provide a questionnaire and a self-assessment checklist including a guide available for download.

14.09.2026

CRA reporting obligations from 11 September 2026: triggers, deadlines and reporting channels

Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities and serious security incidents within 24 hours. The Cyber Resilience Act thus brings the first manufacturer obligation forward by more than one year before full application. We show what triggers the reporting obligation, when the deadline starts to run and how to report.

09.09.2026

Share Deal in the Financial Sector: Data Valuation, Information Security and ISO 27001

Financial institutions hold extensive customer, transaction, risk and model data. These datasets can drive growth, risk management and efficiency, but are also dependent on a high level of confidentiality, integrity and availability. In a share deal, the target company remains the data controller; however, the cloud, data lakes, platform consolidation and migration create new boundaries of trust. Data valuation must therefore assess data protection, information security, ISO 27001, data quality and operational resilience as a whole.

04.09.2026

Data strategy simply explained: 3 terms that make the difference

Everyone talks about “data-driven companies”. In practice, however, it often remains unclear what exactly this means and where it makes sense to start. Three terms help to structure the entry point: data strategy, Data Governance and Data Management. They stand for the strategic, methodological and operational levels of data management.

31.08.2026

Share Deal in Aerospace & Defense: Data Valuation, Information Security and ISO 27001

In aerospace and defense, design data, test evidence, maintenance information and supply chain knowledge can be major drivers of enterprise value. At the same time, product approval, delivery capability and aftermarket services depend on the confidentiality, integrity and availability of technical information. Private equity due diligence must therefore combine data rights, information security, ISO 27001, cyber resilience and long-term usability in a single valuation model.

27.08.2026

How to create a GDPR erasure concept: templates, deadlines and practical erasure rules

The GDPR clearly stipulates that personal data may not be stored indefinitely. A structured erasure concept helps implement legal requirements, minimise risks and maintain an overview. Find out how an effective concept is structured, which deadlines apply and what matters in practice.