GDPR consulting in Berlin
Updated: 2026-11
For international startups and SaaS companies in Berlin we implement the GDPR in a way that supports growth: data processing agreements enterprise customers accept, a clear basis for every US vendor, privacy by design in the data model, and documentation that holds up in investor due diligence. All in English.
Your region: Berlin
Berlin’s startup ecosystem is international, and many teams work entirely in English while operating under German supervision by the Berlin Commissioner for Data Protection and Freedom of Information. Nearly every product relies on US services, which since 2023 can be based on the EU-U.S. Data Privacy Framework for certified providers, although the framework remains under legal scrutiny.
We know the provider perspective from running our own SaaS products under the GDPR and the Swiss FADP. We work remotely from Zug with teams across Berlin.
How we deliver
DPA that closes deals
A clear data processing agreement with a current sub-processor list shortens enterprise sales cycles.
Vendor register with legal basis
Every vendor is recorded with purpose, location and transfer mechanism, including Data Privacy Framework certification where relevant.
Privacy in the schema
Tenant isolation, minimisation and deletion routines are implemented in the database, not just described in a policy.
Why Innopulse
- —Own SaaS products under the GDPR and FADP.
- —Row-level security and deletion concepts in practice.
- —Remote from Zug, working in English.
Parent service: Data Protection Consulting
Matching offers
GDPR & revDSG audit for SaaS
A data protection audit for SaaS checks whether data flows, processing agreements, deletion concept, and technical measures are GDPR- and revDSG-compliant. The output is a concrete finding with prioritised fixes — from people who run SaaS themselves.
SaaS security & RLS audit
A SaaS security audit targets tenant isolation specifically: is row-level security watertight, does access control hold, are typical Supabase pitfalls (service role in the client, missing RLS) avoided? The output is a finding with concrete fixes.
Privacy notice, legal notice and cookies for website and app
We record which services your website or app actually uses and implement a matching privacy notice, legal notice and cookie solution, under the Swiss FADP and, for EU audiences, the GDPR and ePrivacy law. Technically we ensure optional cookies are only set after visitors choose.
More regions
Data protection consulting in Zurich
International companies in Zurich often operate under two regimes at once: the Swiss revised Federal Act on Data Protection and, for EU customers or group companies, the GDPR. Their headquarters may expect documentation in English. We implement both in processes and systems and document the result in English, with local German versions where staff or authorities need them.
Data protection consulting for Geneva
Geneva's NGOs and foundations handle some of the most sensitive personal data there is: beneficiaries in vulnerable situations, donors, staff in many countries. As private entities they fall under the Swiss revFADP, often alongside the GDPR. We implement data protection in their processes and systems and document it in English. We do not work in French.
Data protection consulting in Zug
International companies in Zug frequently need data protection work in English: group policies reconciled with Swiss law, transfers to entities abroad, and the question of whether an EU representative is required. We handle this from our office in Zug, in person, and implement the results in your systems.
App development in Frankfurt
Frankfurt’s banks, asset managers and fintechs need client portals and internal tools that pass security review and fit DORA’s requirements for ICT providers. We build web apps and PWAs in English with strict tenant separation, EU hosting and the documentation your third-party risk team expects.
More services in Berlin
FAQ
Can we use US cloud services under the GDPR?
Yes, with a valid basis. For providers certified under the Data Privacy Framework an adequacy decision applies; otherwise standard contractual clauses and a transfer risk assessment are needed.
Who supervises startups in Berlin?
The Berlin Commissioner for Data Protection and Freedom of Information is the supervisory authority for companies based in Berlin.
What do investors check on data protection?
Typically the vendor list, data processing agreements, the record of processing, security measures and any past incidents or complaints.