Compliance & data protection
Data processing, data flows and deletion policies are settled before a partner is connected — not repaired afterwards.
In industrial projects data protection is usually checked at the end — once contracts are signed and interfaces are built. By then the sign-off is expensive, or it does not come at all.
We record the data flows before a partner is connected: which personal data arises where, on what legal basis, how long it is kept and who may see it.
Machine and production data is rarely anonymous. As soon as a record can be attributed to a shift, a workstation or an employee badge, the GDPR and § 26 BDSG apply — and the works council has a say.
- Art. 28
- DPA reviewed before connection
- EU
- Processing without a third-country transfer
- TISAX
- Assessment prepared
Outcomes
What you actually receive
Every point is a deliverable, not a promise. It is scheduled at project start and signed off at completion.
- Record of processing activities for the project scope
- Review of the data processing agreements under Art. 28 GDPR
- Assessment of third-country transfers and technical and organisational measures
- Deletion and retention policy with periods per data type
- Draft works agreement for personal machine data
- Evidence file for audits and TISAX assessments
Approach
How Compliance & data protection runs
A fixed approach does not mean every project runs the same way — it means you know at any point what happens next and who is accountable for it.
- 01
Map the data flows
Which personal data arises where, and on what legal basis? We also record what would be technically possible but is not needed.
- 02
Review the contracts
DPA, sub-processors, third-country transfer and technical and organisational measures in detail — against the actual data flow, not against the model clause.
- 03
Fix the concept in writing
Deletion and retention periods are documented bindingly per data type and agreed with the works council and the data protection officer.
- 04
Prepare for audit
Evidence is filed so that an assessment passes without a search — with a mapping from requirement to supporting document.
Marketplace
Providers who deliver this service
We advise and support; delivery is by checked companies from the marketplace. We take no commission from the provider side for it.
Industrial Software
Software partners for production control, machine data capture and integration at the line — with workable answers on data sovereignty and data protection. The company's software beyond the machine — ERP, network, workstation — sits in “IT & Software Solutions”.
HR Services & Payroll
Payroll, time management and applicant handling as an outsourced process — with a data processing agreement, processing inside the EU only, and documented deletion periods under § 26 BDSG.
Supplier Management & Audits
Auditors and qualification providers for supplier assessment, first-article inspection and due-diligence duties under the LkSG — with the audit report in the original rather than the supplier's own declaration.
More services
Often goes with
The modules interlock — combine them the way your project requires.
Talk to our team directly
Prefer to speak to someone? Arrange a first conversation, without obligation, with one of the people responsible for your sector.