Approach
The use of
IT solutions in companies is subject to numerous regulatory requirements that
vary depending on the purpose and design.
For
example, the General Data Protection Regulation and the Federal Data Protection
Act play a decisive role in the processing of personal data; in the case of
outsourcing projects for banks and insurance companies, for example, the
requirements of BaFin (such as MaGo and MARisk, BAIT, VAIT, EBA guidelines) and
European legal framework conditions must also be observed.
Depending
on the sector, other sector-specific regulations may also apply. Our advice
begins with the identification of the relevant legal requirements. For internal
projects, we develop the catalogue of requirements in collaboration with the
internal stakeholders and support the creation of the necessary documentation.
When using
external service providers, we review the provider's solution and contractually
ensure compliance with the relevant requirements.
Range of services
The range of services in the area of IT & Technology is broad and covers legal advice in connection with all regulatory and contractual requirements:
- Implementation of internal IT projects
- Outsourcing, involvement of external service providers
- Advice on official enquiries, investigations and proceedings (e.g. data protection supervisory authorities, Federal Network Agency, BaFin)
- Internal roll-out (company agreements, binding company guidelines, training for employees)
- Ensuring compliance with all regulatory requirements (GDPR, BDSG, sector-specific regulation, IT Security Act/CritisVO, Telecommunications Law, Telemedia Law)
IT-CMS
Our compliance experience includes the assessment, management and handling of a variety of third-party vendors, including
- Risk analysis
- Establishment of RMS and CMS
- Monitoring of systems and processes
- Training and education