Data protection law firm Hamburg · GDPR advice for businesses
We advise businesses on data protection law: reviewing existing processing operations, supporting new projects and dealing with the supervisory authorities. Lawyers at the law firm cogito.legal in Hamburg, since 2017.
The data protection law firm cogito.legal in Hamburg is a commercial practice specialising in particular in comprehensive advice on data protection. We provide legal advice tailored to your organisation. Our expertise extends in particular to data protection, IT, media and copyright law.
At every level of advice, our lawyers and legal staff bring many years of experience, both as external consultants and in-house. We have TÜV-certified data protection officers and data protection auditors available for external appointments and for training.
We record which personal data are processed in your organisation and measure that inventory against the requirements of the GDPR — department by department, system by system.
Where processing is likely to result in a high risk, Article 35 GDPR requires an impact assessment. We carry it out and document it so that it withstands scrutiny.
We review and draft the agreements with your service providers — from cloud platforms and payroll bureaus through to document destruction.
We examine on what basis your data leave the territory of the European Union, and we close the gaps.
We classify your AI systems into the risk categories of the AI Act and align its requirements with those of the GDPR. What also matters is whether you provide a system or deploy it.
The deadline is 72 hours. We assess the incident, draft the notification to the supervisory authority and take over the subsequent correspondence.
If a supervisory authority opens proceedings, we represent you — in writing, at the hearing and before the courts.
We train your staff on the work they actually do, not on the wording of the statute.
We operate the internal reporting channel under the German Whistleblower Protection Act (HinSchG) on your behalf — as an independent body outside your organisation.
Once the review is complete, we issue a certificate of examination. The seal displays it on your website, together with the scope of the review and the period of validity.
Behind every mandate stands the firm's data protection team — lawyers and legal staff with many years of experience, both as external consultants and in-house. Your contacts for data protection at cogito.legal are:
You are looked after throughout by the lawyers who know your organisation and its processing operations. Changing responsibilities and repeated briefing do not arise.
Experienced lawyers and certified specialist lawyers are at your side — in project implementation, in contract management and in all other matters of data protection.
Together with our partner companies we have worked at the interface with IT for years and know the technology behind the processing operations that have to be assessed in law. That shortens the coordination with your IT.
We represent you before the supervisory authorities and, where necessary, before the courts — in administrative fine proceedings as well as in civil disputes over access and damages.
Before and during M&A processes we examine the target company's data holdings for legacy issues: missing legal bases, ineffective processing agreements, unresolved third-country transfers. We assess the exposure to administrative fines, draft warranties and indemnities and support the integration after closing.
We examine in advance whether your documentation and your processes will withstand the criteria applied by the certification body, close the gaps and support the procedure through to sign-off. The same applies to customer and group audits in which your level of data protection has to be demonstrated — from the questionnaire to the on-site visit.
The EU AI Act and the GDPR interlock. We establish the legal basis for training and input data, classify the system into its risk category, examine the obligations of provider and deployer and draft usage policies and works agreements that make deployment within the organisation sustainable. Where a system is procured, the provider's documentation is reviewed as well.
datenschutzrechtsanwälte.com
Example — the name, number and validity date are fictitious.
The seal states what was reviewed, for whom, how long the review remains valid and the reference under which it is recorded. It claims no accreditation; it evidences a review carried out by lawyers.
Placement in the footer of the client's website, from 133 px wide
Tell us what the matter concerns and when it suits you. We will come back to you with a confirmation or an alternative proposal.
+49 40 232 053 000