IT law, data protection and digitalization

We draft, verify and negotiate IT contracts for software, hardware, IT projects and maintenance – a practicable approach that is geared towards your business goals. This allows us to create a reliable legal foundation for your IT and avoid future disputes. It also means that we are at hand if an IT project runs into difficulties or needs to be restructured.

We advise providers and users of cloud and SaaS solutions when it comes to creating and negotiating a contractual basis that serves their specific interests – including license agreements, service level agreements, data protection and IT security. In doing so, we create reliable legal frameworks for digital business models and cloud projects while also helping to avoid legal risks early on.

We help companies to design and operate online shops, platforms and digital business models with full legal compliance. Here, we provide expert assistance in areas such as general terms and conditions, checkout process[IW1.1], information requirements and consumer protection – as well as data protection, cookie banners, website audits and contracts with service providers. In this way, you can rest assured not only that your e-commerce operation is 100% legally compliant but also that everything functions exactly the way you need it to.

When IT projects run into problems, we are able to gauge technical and legal conflicts quickly, assess claims precisely and develop a clear strategy for negotiation, escalation management or judicial enforcement. With a solid understanding of IT processes, contracts and project realities, we represent your interests both in and out of court.

We advise companies on legally compliant ways to use open source software, including implementing OSS components in their own software products. This involves keeping a close eye on license obligations, copyleft requirements and contractual arrangements.

We advise providers and users of AI products on compliance requirements, especially within the scope of the AI Act. These range from legal classification and risk assessment to responsibilities relating to transparency, documentation and governance and the practical implementation of regulatory guidelines.

Whether you are procuring or offering an AI model for integrating in a specific software – or an AI system or complex product with AI components – it is vital to have a clear contractual basis. We draft, verify and negotiate AI-related contracts, which ranges from defining the exact scope to covering areas such as usage rights, licenses, liability, responsibilities and impaired performance.

We help companies with internal AI compliance and AI governance – this involves anything from rolling out individual AI applications such as chatbots to integrating generative AI within business processes. Together, we lay the foundations for a legally compliant and responsible in-company use of AI.

As external AI officers, we help your company to use AI in a way that is responsible, structured and legally compliant. Similar to the role of external data protection officers, we are the central point of contact for top management, specialist areas, IT and compliance. We are there to assist you in organizing and managing your AI activities so that regulatory requirements can be implemented in a practicable way and so that risks can be identified early on.

We train top management, managers and employees on AI readiness and AI skills as well as on the legal requirements relating to AI usage. Our hands-on training is geared towards the specific usage cases in your company, so that AI can be used securely and in accordance with the law.

With our expert assistance, companies can ensure that their digital business models and software products comply with data protection requirements from the outset, without getting in the way of technical innovation and economic scalability. Here, we undertake a realistic examination of data flows, legal bases, role allocations and risks. On this basis, we develop robust solutions ranging from product design and contract and documentation structures to data protection impact assessment.

We help companies set up, verify and optimize a highly effective data protection organization that meets legal requirements at all times while also fitting with internal workflows, responsibilities and control processes. To this end, we develop risk-based compliance structures, directories, TOM concepts, reporting processes and auditing measures in such a way that data protection can be put into practice while also being well documented.

We examine external service providers, cloud solutions and new software prior to rollout to determine how the roles under data protection law are allocated and what requirements exist with regard to contracts, data security and documentation.

We provide ongoing assistance to companies in dealing with data privacy incidents and data subject requests with full legal compliance. In this way, we ensure that risks are assessed quickly, that all deadlines are adhered to and that any steps that need to be taken vis-à-vis supervisory authorities or data subjects can be implemented securely. We are at hand to provide expert advice from the initial classification and the internal documentation and communication all the way to the reporting of data privacy incidents. This also includes responding to requests to provide information or erase data or to any other requests relating to other data subject rights.

We represent companies in data protection law disputes with supervisory authorities and in court – for example in the case of investigation procedures, court orders, fines or damage claims. Here, we combine procedural experience with technical and data protection law expertise. This allows us to classify risks precisely, develop robust defense strategies and establish solutions that make good business sense.

If required, we can assume the function of external data protection officer, appointing experienced lawyers from our team who are also certified data protection officers. This enables us to combine legal expertise with practical data protection organization and to provide ongoing assistance to top management and specialist areas in consulting, monitoring, training, data protection impact assessments, data breaches and communication with supervisory authorities.

We train top management, managers and employees from areas such as sales, marketing and HR on practical data protection questions relating to customer data, employee data, data subject rights, data security and data breaches. In this way, we help to bring about a better understanding of data protection-compliant practices in the company, while reducing typical sources of errors in operational processes and creating training certificates as part of a robust data protection organization.

If requested, we can make our Möhrle Happ Luther Privacy Manager tool available to clients. This tool maps data protection information, documentation and central compliance processes digitally in a clear, transparent structure. In this way, we help our clients with the ongoing maintenance of processing activities, service providers, contracts, TOM, erasure concepts, data subject rights and training, thereby combining legal counselling with a practical tool for everyday business.

We provide expert advice on the legal requirements associated with networked products and related services. In doing so, we translate regulatory guidelines – primarily from the Data Act – into clear, practicable steps for your company.

Data use agreements

We advise cloud service providers and customers on the requirements of the Data Act, particularly those relating to cloud switching. This involves providing expert assistance in contractually implementing switching rights, exit processes, portability and fair contractual terms – so that cloud provider switches can be prepared in compliance with all legal requirements and can be carried out quickly and easily.

With the NIS2 Directive, the KRITIS umbrella act for critical infrastructure protection (in Germany) and other regulatory guidelines relating to IT security, companies are faced with more and more requirements for safeguarding their digital systems effectively from an organizational, technical and legal perspective. We provide expert assistance in classifying the affected business areas, implementing governance, risk and documentation requirements and preparing for reporting, supervisory and liability questions.

From December 11, 2027, providers of digital products – such as software and networked devices – must meet extensive requirements from the Cyber Resilience Act concerning the IT security of digital products. We advise providers of digital products on how to comply with the requirements of the Cyber Resilience Act, from regulatory classification, security and documentation requirements to contractual safeguarding in the supply chain.

We advise finance companies and IT service providers on implementing the DORA requirements relating to secure and resilient ICT systems. This is centered mainly on drafting suitable contracts and defining clear responsibilities, effective control processes and legally compliant processes for dealing with IT failures and security incidents.

In the case of cyber attacks, security gaps or data leakage, it is vital to take fast, legally compliant action and to coordinate technical, regulatory and communications measures effectively with one another. We work with companies to produce a legal assessment of security incidents and to meet reporting requirements vis-à-vis authorities and data subjects. We also help them with documentation, communication and dealing with IT forensics experts, insurance companies and service providers.

We draft, verify and negotiate IT contracts, focusing in particular on IT security and supply chain compliance. This involves ensuring that security requirements, reporting channels, control rights, responsibilities and liability questions are clearly regulated and that regulatory guidelines are also adhered to in working relationships with service providers and suppliers.