Dealing with the data protection authority: your representation
We are your legal representation towards the data protection authority, not the authority itself. A letter from it is not yet a fine. What you write now does bind you in the proceedings, however.
The first steps
Step 1: Record deadline and subject
What exactly does the authority want to know, by when, and which type of proceedings are we in? Hearings, complaint proceedings and fine proceedings follow different rules.
Step 2: Establish the facts internally
Before anything goes out, it has to be clear in house what actually happened and what is documented. Contradictions between your response and your records are the most expensive mistake.
Step 3: Consider an extension
Where establishing the facts takes longer, a reasoned request for an extension is frequently granted. It beats a fast but incomplete answer.
Step 4: Agree the response
We draft the answer, place it in its legal context and agree with you which documents to attach and which not.
Step 5: See the proceedings through
From the hearing through possible orders to the fine notice and any challenge to it.
What helps and what hurts
Works in your favour
- A timely, orderly response with a structure the reader can follow
- Documented remedial measures started before the enquiry
- Visible cooperation with the authority
- Records of processing activities that match actual operations
Works against you
- Silence or letting the deadline pass
- Statements that contradict your own records
- Documentation created after the fact and recognisable as such
- Remediation only after the enquiry and only when expressly required
Who is on which side here
The data protection authority is a public body that investigates breaches and can order measures. We are not part of it. We are the firm that represents you towards it, from the first hearing through requests for information and orders to the fine notice.
Which authority is competent depends on where you are established and on the nature of the processing. We represent you throughout Germany before whichever body is competent. Complaints from individuals also land there and trigger proceedings in which you have to respond.
How we support you
We take over the correspondence, place the facts in their legal context and represent you throughout the proceedings. Where a fine notice is issued, we assess the prospects of a challenge and conduct it.
A letter from the authority?
Do not answer off the cuff. We will look at it at short notice.
Get in touch nowFrequently asked questions
Do we have to respond to a request for information?
Yes. The supervisory authority has investigative powers, and cooperation is a duty rather than a courtesy. The question is not whether you answer but what you answer. Extensions are often available where the reasons are plausible, and a phone call is worth more than letting the deadline pass.
Do we have to incriminate ourselves?
This is one of the harder questions in the proceedings. Duties to provide information and protection against self-incrimination stand in tension, resolved differently depending on the type of proceedings. This is precisely where legal support pays off, before the first response goes out.
What determines the size of a fine?
Art. 83(2) GDPR sets out the criteria, among them gravity and duration, intent or negligence, remedial measures taken and the degree of cooperation with the authority. The degree of cooperation is what you can still influence during proceedings.