POT Falkenberg GmbH POT Falkenberg Hünfelden · Offenbach

Hünfelden · Offenbach

Data protection support under DSGVO and BDSG

Privacy compliance is not a document you sign once. It is a set of processes that have to keep working while staff change, systems move and regulations develop. We support organizations that need this handled properly without a full-time privacy department.

Request a Privacy Audit See IT Consulting
A hand resting on a closed binder under a single warm lamp on a dark desk

Starting point

Where a privacy program usually stands

Organizations arrive at different points. Some have a folder from an earlier project and nothing since. Some have a coordinator doing their best with no time allocated. Some are preparing for a specific audit and need everything in order by a date.

The starting point determines the work. A short review tells us what exists, what is current, and what has drifted out of sync with reality. That last category is usually the largest, and it is the one that creates risk.

  • An older project folder, untouched since it was filed
  • A coordinator working without dedicated hours
  • A date on the calendar and documents to prepare

The audit

What a Datenschutzaudit covers

A Datenschutzaudit looks at your processing activities, legal bases, contracts with processors, technical and organizational measures, and how Betroffenenrechte are handled in practice. We check the documents against what actually happens in the systems and the office, because the gap between the two is where findings live.

The result is a written report: what is in order, what needs attention, and what order to tackle it in. Findings are ranked by risk and effort, not dumped as a flat list of a hundred items.

Reviewed

Processing activities and legal bases

Where data comes from, why it is held, and what the record says versus what the teams do.

Reviewed

Processor contracts and measures

Agreements with service providers, plus the technical and organizational measures they rely on.

A lit doorway seen from a dim hallway with an open binder on a table inside

Registers

Two pieces of privacy work that only count if they keep working after we leave.

Documentation you can maintain

Records of processing activities, processor agreements, deletion schedules, the description of technische und organisatorische Maßnahmen. These documents only help if they stay accurate, which means they need to be maintainable by the people who actually work with them. We write them in plain language and build a simple routine for updating them when a new system or a new process appears. Documentation that takes a specialist to update will be stale within a year, and stale documentation is worse than none in an audit.

Betroffenenrechte as a working process

Access, correction, deletion and restriction requests arrive by email, by post, sometimes verbally. Each one starts a clock. The work is to make handling them routine: a defined intake point, a checklist of systems to search, clear criteria for when an exception applies, and a documented reply. We set this up with your team and test it against a realistic request. Organizations that have run the process once handle the next request in a fraction of the time, and with far less anxiety.

Löschkonzepte and retention

Deletion is the part of privacy work that quietly accumulates debt. Emails from 2015, applicant files that were never removed, shared drives with no naming rule and therefore no way to identify what may be deleted. A Löschkonzept defines retention periods per document category, connects them to where the documents actually live, and specifies who executes deletion and when. We work through the uncomfortable areas too: backup copies, archives, and systems where deletion is technically limited. The concept names those limits instead of pretending they do not exist.

TOM

Technische und organisatorische Maßnahmen

TOM are the bridge between your privacy documentation and your IT environment. Adequate measures depend on the risk, the data, and the state of your systems, which is why generic checklists fall short. We assess what you have, identify gaps, and describe the measures in a form that matches how your systems are actually configured.

Because IT-Beratung and Datenschutz sit in the same consultancy, the measures we document are the ones your IT setup can support. No promises your infrastructure cannot keep.

See how IT consulting fits
A server rack in low light with a single glowing status light and a hand adjusting a cable

External Datenschutzbeauftragter or internal coordinator

Both models work, and the right choice depends on your size, sector and how much privacy work actually arises. Some organizations combine the two: a coordinator inside, an external officer for oversight and reporting. We support all three arrangements.

External officer

Independence and current knowledge, without a full-time salary

Suits organizations with steady but limited privacy demands. Reporting and oversight stay at arm's length from the teams handling the data.

Internal coordinator

Someone who knows the business, given training and time

Handles day-to-day questions faster because they already know the systems and the people. The condition is real training and allocated hours, not an extra duty on top of another job.

Combined

A coordinator inside, an external officer for oversight

The internal role keeps the daily work moving; the external officer carries reporting, independence and a second pair of eyes on the register.

Ask about the Datenschutzbeauftragter role Training for a coordinator

Regulatory shift

Current topics: NIS-2 and the EU Data Act

Privacy work no longer stops at personal data. NIS-2 brings cybersecurity governance requirements that overlap with privacy organization, particularly for organizations in critical sectors. The EU Data Act adds questions about data access and sharing that go beyond classic DSGVO territory.

We handle these as they touch your operations: which obligations apply, what they change in your existing documentation, and where the overlap with privacy work lets you avoid doing the same job twice. Regulatory fashion is not a reason to start a project; actual applicability is.

Compliance note

Applicability comes first. NIS-2 and the EU Data Act do not apply to every organization, and a project started for a regulation that does not reach you spends time you could put into the register. We begin by checking sector, size and the data you actually process, then say plainly whether the obligations land on you.

Public sector

Working with municipal and public-sector clients

Public administration has its own privacy landscape: citizen data, committee processes, specific retention rules, and often limited specialist capacity. Our municipal privacy work covers the practice questions that arise in that setting rather than corporate templates.

The Hünfelden office is well placed for local government clients in southern Hesse, and the Offenbach branch office covers public bodies in the Rhine-Main area. Sessions and reviews run on site or online, whichever fits the schedules of the people involved.

Where we sit

Head office
Nassauer Straße 5, 65597 Hünfelden, Germany
Branch office
Kaiserstraße 29, 63065 Offenbach, Germany
Managing director
Waltraud Falkenberg · HRB 6640
Office hours
Monday to Friday, 9:00 AM – 6:00 PM

Practical help

Already have documentation? Start with a review

Many organizations do not need a rebuild. A review against your actual systems and processes usually shows what can be kept and what needs updating. That is a shorter piece of work than starting again, and it tells you where the gaps actually are before anyone writes a new binder.

Bring what you have: the record of processing activities, processor agreements, any deletion rules, and the last version of your technical and organizational measures. We read them next to how the systems are configured and report back in plain language.

Discuss documentation support Office organization support
Hands turning the pages of an open binder under a single warm lamp on a dark desk

Questions we are asked before a project starts

Short answers to the four questions that come up most often when organizations compare an external officer with an internal role, and when they already have a folder of documents.

What is the difference between an internal and an external Datenschutzbeauftragter?

An internal officer is employed by the organization; an external one works under contract and brings independence. The external model suits organizations with steady but limited privacy demands.

We already have documentation. Can you review it rather than rebuild it?

Yes. A review against your actual systems and processes usually shows what can be kept and what needs updating.

How current is your knowledge of NIS-2 and the EU Data Act?

We track both as they develop and cover them where they actually apply to a client's sector and size, rather than treating every new regulation as universally relevant.

Do you take on the Datenschutzbeauftragter role directly?

We support both arrangements and can act as external officer where that fits the organization's size and sector requirements.

What we cover

Data protection inside a wider consultancy

Privacy work rarely stands alone. A register is easier to keep when the IT environment behind it is understood, when staff have been trained on how to handle requests, and when the filing rules in the office match the retention schedule. POT Falkenberg GmbH delivers these services together, which is why the documentation we write tends to survive contact with the working week.

Core service

Datenschutz

Audits, documentation, Löschkonzepte, technische und organisatorische Maßnahmen, Betroffenenrechte, and the Datenschutzbeauftragter role where it fits. The page you are reading covers this work in detail.

Adjacent

IT-Beratung

The systems that hold personal data, reviewed and configured so the measures on paper match the reality.

Adjacent

IT-Schulungen

Training for the people who handle requests, so a coordinator has the knowledge to run the process.

Adjacent

Büroorganisation and administrative Dienstleistungen

Filing rules, naming conventions and administrative routines that make a retention schedule executable instead of aspirational.

Who we are

POT Falkenberg GmbH

Undernehmensberatung led by Geschäftsführerin Waltraud Falkenberg, registered as HRB 6640, with offices in Hünfelden and Offenbach.

Tell us where your privacy work stands

Send a short description of what exists, what has changed since it was written, and whether a date is driving the work. We will tell you what a review would cover and what it would not, before anything is booked.

POT Falkenberg GmbH · Nassauer Straße 5, 65597 Hünfelden, Germany · Branch office: Kaiserstraße 29, 63065 Offenbach, Germany · Monday to Friday, 9:00 AM – 6:00 PM

Contact POT Falkenberg GmbH About POT Falkenberg Review this page's services again