Record and TOMs
Almost every company needs a record of processing activities (Art. 30 GDPR) and documented technical and organisational measures (Art. 32).
DATA PROTECTION & AI COMPLIANCE
Data protection and AI rules. Properly documented.
For IT companies, agencies and businesses that use AI: we build the documents that customers, auditors and authorities ask for, and keep them up to date. As your external data protection officer and as ongoing support.
No legal advice: contracts and legal review of individual cases stay with your law firm.
WHAT MATTERS
What customers and authorities want to see.
Data processing
Every service provider that processes personal data on your behalf needs a DPA under Art. 28 GDPR. Customers ask for it before they sign.
Data protection officer
If at least 20 people are regularly involved in the automated processing of personal data, a data protection officer is mandatory in Germany (Section 38 BDSG). The role can be filled externally.
AI literacy
Companies that use AI must take measures under Art. 4 of the AI Act that support the AI literacy of their staff. Documented training is the simplest evidence.
SERVICES
What we take on.
External data protection officer
Appointment with proof of expertise under Art. 37(5) GDPR, contact for the supervisory authority and data subjects, annual report to management.
GDPR documentation
Record of processing activities, TOMs, deletion concept and a data breach procedure with the 72-hour notification deadline (Art. 33 GDPR).
DPA management
Record your service providers, obtain DPAs, check them against the mandatory content of Art. 28(3) GDPR and track changes.
AI inventory and usage policy
Which AI tools are in use, which data may go into them and who approves. As a short policy your team actually reads.
AI literacy training
Training under Art. 4 of the AI Act for your team, online or on site, with a record of attendance for your files.
Security questionnaires
We answer your customers’ data protection and security questions based on your documentation, so offers do not get stuck there.
PACKAGES
Indicative prices.
Fixed monthly price after the check. What is listed in the package is included; additional work, such as a data breach involving the authority, is billed by the hour and announced in advance.
Compliance check
Starting point. Review of data flows, service providers and existing documents, gap list with a plan.
One-off€990
Credited against the first monthly fees of a package.
Data protection
Ongoing support, up to about 50 employees.
Monthlyfrom €690
Included
- External data protection officer
- Record of processing activities and TOMs
- DPA management for your service providers
- Data breach procedure
- Annual data protection briefing
Data protection & AI
For companies that use AI tools or offer AI products.
Monthlyfrom €990
Included
- Everything in “Data protection”
- AI inventory and usage policy
- AI literacy training under Art. 4 AI Act, annually and for new staff
- Answers to your customers’ security questionnaires
AI literacy training also on its own: from €1,490 per session, up to 15 people, online or on site, with a record of attendance. Larger companies by scope. All prices net plus VAT.
Market rates according to providers: external data protection officer about €100–500 per month for small businesses and €600–1,500 for mid-sized companies, in-house AI training €1,500–5,000 per day. Our packages also include documentation, DPA management and the AI topics.
THE BOUNDARY
What we do not do.
We are not a law firm and do not give legal advice on individual cases. In Germany, only lawyers may draft contracts and terms, assess legal risks and represent you before authorities or courts. If your case needs that, we tell you. Certifications such as ISO 27001 are only issued by accredited bodies.
WITH YOUR AI PROJECT
Security & data protection ↗The documentation comes with it.
If we build an AI solution for you, the DPA, TOMs and the data flow description are created as part of the project. How we handle data in our own projects is described on the Security & Data Protection page.
FAQ
Before we start.
Do we need a data protection officer?
Usually yes in Germany if at least 20 people are regularly involved in the automated processing of personal data (Section 38 BDSG), or if sensitive data is part of your core business. The other GDPR obligations apply either way.
What does Art. 4 of the AI Act require?
Companies that use AI systems must take measures that support the AI literacy of their staff. Since the 2026 amendment, no specific level per person is required. Common practice is training with a record of attendance and a short usage policy.
Does this replace our law firm?
No. We take on documentation, organisation and the role of the data protection officer. Contracts, terms and legal review of individual cases belong with a law firm.
How do we start?
With the compliance check: we review data flows, service providers and existing documents and deliver a gap list with a plan. The check is credited against the first monthly fees of a package.
Who is the contracting party?
M2D GmbH, Am Turm 11, 53721 Siegburg, Germany.
THE NEXT STEP
What should work better in your business?
Tell us about a process that takes up your team’s time. We discuss where automation could help and what is needed to define the next step.
Useful details: number of employees, software and AI tools in use, and whether customers already ask for DPAs or security questionnaires.
HEINRICH SCHNEIDER / DDC
heinrich@ddc.companyPrefer email? Write to us directly.
Contracting party: M2D GmbH, Am Turm 11, 53721 Siegburg · initial call free of charge · Pricing · Security & data protection