GDPR
Law Firm
Why choose GDPR with ARROWS?
Every entrepreneur today faces stringent data protection regulations. Whether you operate an e-shop, run a growing startup, or manage an established company, improperly implemented GDPR can cost you not only hefty fines but also the loss of customer trust. Data protection laws are continuously tightening, and breaches can result in fines amounting to millions.
You might think you’ve already got everything under control. Perhaps you implemented GDPR in 2018, established the necessary rules, updated contracts with suppliers, and trained your employees. However, the interpretation of these rules is continuously evolving. Supervisory authorities issue new methodologies, and emerging EU case law is clarifying exactly how companies should comply. Today, inspections focus on previously overlooked vulnerabilities.
For example:
Transferring Data Outside the EU – Do you use cloud services from American providers? Do you share data with a parent company outside the EU? The new EU standard contractual clauses must be properly implemented, and it often takes more than simply signing a template contract – you may also need to provide a transfer impact assessment to evaluate all risks associated with data transfers.
Camera Systems – GDPR now applies not only to recording cameras but also to online camera systems. If cameras monitor employees, you must consider not only GDPR but also the stricter regulations of labor law.
Data Protection Officer – Think you don’t need one? You might, or you might not. If you process large amounts of personal data, regularly monitor clients, or work with sensitive information, you may be required to appoint a Data Protection Officer. Inspections by the Data Protection Authority focus on the proper functioning of these officers.
Security Incidents and Data Breaches – Should a security incident occur, you have only 72 hours to assess its impact and, if necessary, report it to the authorities. Do you know how to properly evaluate risks and determine when reporting is mandatory?
GDPR is no longer just about drafting documentation. It involves continuous risk management and regular updates to align with new rules and regulatory interpretations. Leave it to us – we monitor legislative changes on your behalf and ensure your company remains in compliance.
Need a consultation in personal data protection?
Your data, your rights. GDPR has introduced stricter rules for personal data protection and granted EU citizens greater control over how their data is used. Are you confident that your company meets all obligations? Are you sure you can avoid hefty fines?
We will help you establish the right processes to ensure your business complies with regulations – without unnecessary complications or administrative burdens.
And it’s not just about large companies – GDPR applies to everyone handling personal data. Whether you run an e-shop, provide services, or manage a client database, these rules concern you.
Leave the legal complexities to us and focus on your business. We will ensure everything is set up correctly so you avoid sanctions and strengthen your customers’ trust.
How will we help you?
At our law firm, we have a team of specialists dedicated to GDPR. We design practical, functional solutions tailored to your business needs. Whether you require a quick consultation or a complete GDPR implementation, we are here for you.
Quick response – We reply within 24 hours
Clear solutions – No complex legal jargon, only straightforward guidance
Expert advice – We know where inspections commonly find errors and will help you avoid them
Proper data protection is not a one-time task. To keep your company safe, it is essential to continuously monitor legislative changes, update your processes, and be ready to demonstrate your compliance during an inspection. We help you achieve exactly that.
From analyzing and setting up internal protocols to providing legal advice and representing you before authorities – we ensure your GDPR practices are not only compliant but also practical and effective.
What legal services do we provide?
Analysis and setup of internal data protection processes – We identify vulnerabilities and propose solutions.
Data protection impact assessment (DPIA) – If you handle sensitive data, we help assess and mitigate risks.
Appointment of a data protection officer (DPO) – If required, we provide a qualified expert.
Legal advice on pseudonymization of personal data – To help you protect data efficiently and correctly.
Maintenance of processing records – Essential for both internal tracking and regulatory inspections.
Representation before supervisory authorities and in court – If issues arise, we will stand by your side.
Selected legal specialists for you
Read our experts' articles
Transferring customers' personal data to an external processor
Your customer data sits in a cloud CRM, payroll is handled by an external accountant and a marketing agency sends out your e-mails. Each of them works with personal data of your people and customers, and you are responsible for whom you entrust it to and on what terms. The regulation therefore requires a written agreement with prescribed content. The lawyers of ARROWS law firm will set it up so that it actually protects you in the event of a data breach.
GDPR Legal Training for E-Shops
GDPR training for e-shops should align consent forms, cookies, email marketing and supplier contracts so that marketing, IT and customer service all follow the rules – violations can trigger fines of up to EUR 20 million or 4% of turnover. Find out what training actually reduces the risk of a fine.
GDPR Compliance Without Red Tape
A missing or inadequate data processing agreement with a processor, such as a cloud provider or payroll service, is itself a GDPR violation carrying a fine of up to €20 million or 4% of turnover, regardless of whether a data breach occurred. Find out what regulators actually check during an inspection and how to set up data protection without slowing down your business.
Data Management in Gambling
Gambling operators must verify a player's identity and politically-exposed-person status before they can deposit money, which means processing sensitive personal data at scale. A GDPR setup mistake — such as a missing data-processing agreement — is itself a breach carrying a fine running into millions of euros, regardless of whether any data actually leaked. We explain how to set up player data protection without slowing down registration and play.
GDPR inspections in practice
A GDPR inspection can begin with a formal notice or directly on site, and a company must be able to show how personal data is actually processed and protected. Policies on paper are not enough; the authority may request documents, explanations and access to systems or premises. This article explains how an inspection proceeds, what to prepare in advance and how to respond to regulatory requests without avoidable mistakes.
GDPR a zaměstnanci
GDPR a zaměstnanci omezuje, jak může firma sledovat počítače, e-maily, kamery, GPS nebo práci na home office, i když chce chránit majetek či kontrolovat výkon práce. Souhlas zaměstnance obvykle nestačí a nezákonně získaný důkaz může selhat i v pracovním sporu. V článku zjistíte, kdy je monitoring oprávněný, co musí obsahovat balanční test a jak zaměstnance správně informovat.
Thanks to our clients
since 2015 we have been recognised in the Law Firm of the Year, Law Offices of the Year and Legal500 categories.
Join the clients who trust us
We are trusted by e.g. the Czech Ice Hockey Association, MONETA Money Bank and dozens of real estate agencies.