GDPR / DSGVO
Personal data: purposes, legal bases, individual rights, security and accountability. Germany’s BDSG must also be considered where relevant.
Official source07 / IT legal operationsFreedom to build.
Freedom to build.
Clarity in the rules.
Trust comes first in the European market. We connect privacy, contracts and digital products so requirements become part of interfaces, code and everyday operations.
Law and technology.
Working together.
Website, SaaS or app: we start with markets, users and the business model. Then we define tasks for legal review and technical delivery.
01Privacy · GDPR / DSGVO
Make personal data processing accountable.
+
Privacy · GDPR / DSGVO
Make personal data processing accountable.
Scope of work
- Map data flows, purposes and party roles
- Legal bases, retention and data subject requests
- DPA / AVV, DPIA screening and international transfers
Your outcome
An agreed plan for documentation, processes and product changes.
02Websites, cookies & e-commerce
Align documents with how the site actually works.
+
Websites, cookies & e-commerce
Align documents with how the site actually works.
Scope of work
- Impressum, privacy notices and consumer information
- Inventory of cookies, analytics and external services
- Consent, refusal and withdrawal; checks on optional tools
Your outcome
Requirements for notices, consent interfaces and user journeys.
03IT contracts & SaaS
Make each party’s commitments clear.
+
IT contracts & SaaS
Make each party’s commitments clear.
Scope of work
- Development, maintenance, SaaS and licensing terms
- Scope, acceptance, SLA, fees and changes
- Liability, confidentiality, termination and handover
Your outcome
A contract structure and agreed commercial points for legal drafting.
04Code, design & intellectual property
Understand ownership and permitted use.
+
Code, design & intellectual property
Understand ownership and permitted use.
Scope of work
- Usage rights for code, design, content and documentation
- Employee and contractor arrangements
- Open-source software, fonts, images and third-party licences
Your outcome
A rights map, required permissions and gaps in the chain of rights.
05AI & digital platforms
Address rules during product design.
+
AI & digital platforms
Address rules during product design.
Scope of work
- Company role and system purpose under the AI Act
- Transparency, data, human oversight and internal rules
- DSA applicability for intermediary services and platforms
Your outcome
Relevant requirements and tasks for product, people and documentation.
06Accessibility & compliance processes
Turn requirements into verifiable actions.
+
Accessibility & compliance processes
Turn requirements into verifiable actions.
Scope of work
- EAA / BFSG applicability, including exemptions
- Accessible interfaces, forms, payment and information
- Task owners, evidence and change management
Your outcome
An implementation and verification plan. Standards and certification are considered separately.
ZIEL coordinates product and technical implementation. Individual legal assessments and legal documents must be handled by a professional authorised in the relevant jurisdiction. Their engagement and scope are agreed before work begins.
European context.
Practical requirements.
EU legislation and national laws address different issues. Applicability depends on the company’s role, product, market and users.
TDDDG § 25
Storing or accessing information on a device generally requires consent, with statutory exceptions including operations strictly necessary for a requested service.
Official sourceDDG § 5
Assess Impressum applicability and content: provider identity and accessible contact details.
Official sourceAI Act
Determine provider or deployer role, purpose, risks, applicable duties and timelines for the system.
Official sourceDSA
Assess rules for intermediary services, including hosting and platforms. Duties depend on service type and size.
Official sourceEAA / BFSG
Assess covered products or services, exemptions and accessibility requirements. The BFSG does not apply equally to every website.
Official sourceLaw ≠ standard ≠ certificate. ISO/IEC 27001 and 27701 can support security and privacy management, but do not alone demonstrate fulfilment of every GDPR requirement.
Rules become
part of the product.
Three illustrative scenarios show the approach. They are not client case studies or individual legal assessments.
01 / Launching in Germany
A website for Germany
Forms, analytics and online orders need consistent documents and interface behaviour.
- Identify the operator, audience and order journey
- Review notices, data processing and BFSG applicability
- Implement consent and test journeys before launch
ZIEL / ILLUSTRATIVE PLANYour outcome
01Impressum
02Privacy
03Consent / UX
A launch task pack: professionally reviewed legal text and technical acceptance criteria.
From open questions
to clear processes.
Understand
Review the product, markets, data, contracts and existing operations.
Agree
Clarify applicable requirements with the legal professional and assign responsibilities.
Implement
Connect legal text to settings, interfaces and team procedures.
Verify
Check implementation and define triggers for updating documents and processes.
Key questions
Is publishing a privacy policy enough?+
No. It must reflect actual processing. Legal bases, providers, retention, security and data subject procedures also need assessment.
Does every site need a cookie banner?+
No. First assess what is stored on or read from devices. Strictly necessary operations may qualify for exceptions. Optional tools and personal data processing are assessed separately.
Can we use overseas services?+
It depends on data, roles and processing terms. Assess adequacy decisions or other mechanisms such as SCCs, plus supplementary measures where necessary.
Do you guarantee compliance with every EU rule?+
No. Scope depends on the product and jurisdictions. ZIEL handles agreed technical delivery; legal opinions and documents require an authorised professional.
Can work start before incorporation?+
Product preparation and research can begin, but duties follow actual activity. Provider information, data processing, service offers and registration requirements need separate review before a public launch.
CLARITY BEFORE LAUNCHWhat are you
What are you
bringing to Europe?
Tell us your target market, product and main question. No confidential files or personal data are needed at this stage.