Knowledge Base
FAQs, Guidelines & Fundamentals, Case Studies, Articles, and other information about
digital marketing, data protection & compliance, project management, and AI
What mandatory information must be included in a record of processing activities?
For each processing activity: Controller, Purposes, Categories of data subjects, Categories of personal data, Categories of recipients, Third-country transfers
For each processing activity: Controller, purposes, categories of data subjects, categories of personal data, categories of recipients, third-country transfers including appropriate safeguards if relevant, deletion periods or criteria for their determination, as well as a description of technical and organizational measures.
Additionally, it is practical to include: system reference, process boundaries, roles, data sources, interfaces, responsible owners, and review date.
How do I structure OneTrust if I need to document more than 100 systems?
Work with taxonomy and standards: clear naming conventions, unique system IDs, separation of systems and processes, templates per process class, mandatory field
Work with taxonomy and standards: clear naming conventions, unique system IDs, separation of systems and processes, templates per process class, mandatory fields, quality status, and duplicate rules. Establish intake for new systems via procurement and IT, risk-based prioritization, linking to service providers, contracts, and evidence, as well as reporting with a traffic light status per area. Implementation: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I build a system inventory for data protection and security?
Define scope and data model: System, Owner, Purpose, Criticality, Hosting, Accesses, Data types, Interfaces, Service providers, Sub-service providers, Logging, Re
Define scope and data model: System, Owner, Purpose, Criticality, Hosting, Accesses, Data types, Interfaces, Service providers, Sub-service providers, Logging, Retention. Use unique IDs and naming conventions and link to RoPA, contracts, TOMs, and risk assessments. Implement a maintenance process covering procurement, releases, and vendor changes, otherwise it will become outdated. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I map consent and purposes in OneTrust when using Usercentrics in parallel?
Clearly map consent categories and purposes from Usercentrics to the documented processing activities. Ensure that vendor groups, purposes, date
Clearly map consent categories and purposes from Usercentrics to the documented processing activities. Ensure that vendor groups, purposes, data types, and recipients are consistent in CMP and VVT. Document technically effective consent gating, meaning that tags and SDKs are only triggered after valid consent. Store consent logging, versions, and proofs as evidence. Services: /es/leistungen
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
How do I effectively document data processors and DPA information in OneTrust?
Maintain service providers as separate entities and link them to the relevant processing activities. Document role, scope of services, sub-processors, H
Manage service providers as a separate entity and link them to the affected processing activities. Document their role, scope of services, sub-service providers, hosting, security measures, audit rights, deletion concept, and control mechanisms. Store Data Processing Agreements (DPA) centrally as proof and reference the version, date, and scope. This ensures the documentation remains maintainable and auditable. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I implement joint responsibility and Joint Controllership in practice?
Clarify roles along the data flows: who determines purposes and means, who decides on communication, who fulfills data subject rights. Document this allo
Clarify roles along the data flows: who determines purposes and means, who decides on communication, who fulfills data subject rights. Document this allocation per process and link it to the relevant systems and contracts. Supplement with transparency obligations, contact points, incident roles, deletion concept, and governance for changes. Services: /es/leistungen
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
How do I set up a review process for processing activities that truly works?
Conduct risk-based reviews: high risks more frequently, low risks less frequently. Define owners and deputies, and establish triggers for ad hoc reviews, e.g.
Conduct risk-based reviews: high risks more frequently, low risks less frequently. Define owners and deputies, and establish triggers for ad hoc reviews, e.g., new data source, new service provider, new purposes, new countries. Utilize SLAs, automatic reminders, and quality checklists. Track status via a dashboard and escalate when overdue. Implementation: /mein-shop/p/interims-projekt-management
How do I correctly document marketing tools such as Adobe or Salesforce in the VVT?
Document by purpose and process, not by tool name. Separate analysis, personalization, campaign management, lead management, and service communication. Bes
Document by purpose and process, not by tool name. Separate analysis, personalization, campaign management, lead management, and service communication. For each purpose, describe data sources, profiling, segments, recipients, retention, transfers, and consent dependency. Link the tools as systems that collaborate within a process, and add governance for changes and access. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I make OneTrust entries audit-proof and consistent?
Define a glossary, naming conventions, and mandatory fields. Use templates so that purposes, data categories, recipients, and deletion criteria are comparable. Link
Define a glossary, naming conventions, and mandatory fields. Use templates so that purposes, data categories, recipients, and deletion criteria are comparable. Link evidence such as Data Processing Agreements (DPAs), Technical and Organizational Measures (TOMs), policies, risk assessments, and transfer documentation. Establish review cycles, owners, quality checks, and spot checks. Audit-proof status is achieved through plausibility, consistency, and verifiability, rather than the sheer volume of text. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I practically implement Privacy by Design in documentation and projects?
Anchor Privacy by Design as a mandatory step in the project lifecycle: Intake, Requirements, Architecture, Tool Selection, Testing, Go Live Approval. Use checklis
Integrate Privacy by Design as a mandatory step in the project lifecycle: Intake, Requirements, Architecture, Tool Selection, Testing, Go-Live Approval. Utilize checklists that require specific evidence, such as data minimization, purpose limitation, roles, logging, deletion concept, and consent logic. Link this to ticket processes and the Definition of Done, ensuring it is not merely theoretical. Services: /es/leistungen
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
What services does LJ & Partner offer and what is the quickest way to get started?
LJ & Partner combines Digital Marketing, Data Protection and Compliance, Project and Interim Management, Technologies and E-commerce, as well as Supply Chain Management
LJ & Partner integrates Digital Marketing, Data Protection and Compliance, Project and Interim Management, Technologies and E-commerce, as well as Supply Chain Management into a unified approach. Our procedure involves: 1. Clearly defining goals and problems, such as growth, audit pressure, or tool chaos. 2. Documenting the current state of processes, data, and systems. 3. Establishing priorities and quick wins, then translating them into a roadmap. 4. Initiating implementation as a module and scaling it into a full project if necessary. This approach results in reduced friction between marketing, IT, and data protection, alongside measurable outcomes.
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
How do I handle third-country transfers and Transfer Impact Assessments within the RoPA?
Identify the actual data flow, including sub-processors and actual hosting. Document the transfer instrument, typically standard contractual clauses
Identify the actual data flow, including sub-processors and actual hosting. Document the transfer instrument, typically standard contractual clauses, as well as supplementary measures such as encryption, key management, access controls, and pseudonymization. In the TIA, you evaluate access possibilities, risks, and the effectiveness of the measures, and document the decision transparently. Plan reviews for provider changes. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I document a new system in OneTrust if the department does not provide details?
Work with a minimal data set: purpose, user group, general data categories, system role, hosting, main interfaces, service providers, general retention, risks.
Work with a minimal data set: purpose, user group, general data categories, system role, hosting, main interfaces, service providers, general retention, and risks. Establish follow-up obligations with deadlines, owners, and escalation procedures. Utilize IT sources such as CMDBs, architectural diagrams, and contracts to populate basic data. Mark the entry with a quality status and iteratively refine it. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
How do I correctly set up a processing activity in OneTrust?
OneTrust is only valuable if processing activities are documented completely, consistently, and in a process-oriented manner. Procedure: 1. Define scope and process description
OneTrust is only valuable if processing activities are documented completely, consistently, and in a process-oriented manner. Procedure: 1. Define scope and process description and clarify demarcation from similar processing activities. 2. Clearly justify purpose, legal basis, and legitimate interest, if relevant. 3. Fully record categories of data subjects, data categories, recipients, and third-country references. 4. Document retention periods, TOM measures, and roles such as controller and processor. 5. Establish a review process and designate responsible persons to ensure continuous maintenance. This makes the directory consistent, auditable, and comprehensible for specialist departments.
How do I rescue a OneTrust project that is spiraling into uncontrolled growth and frustration?
Start with an inventory: duplicates, gaps, inconsistent terms, missing owners, missing evidence. Define minimum standards, templates, role mo
Begin with a comprehensive inventory: identify duplicates, gaps, inconsistent terminology, missing owners, and absent evidence. Define minimum standards, templates, a clear role model, and robust governance. Prioritize and clean up the most critical processes based on risk, then establish change control for all new entries. Concurrently, empower departments to reduce back-and-forth queries. Operational Management: /mein-shop/p/interims-projekt-management
Which consulting modules can I book directly and what is their purpose?
The consulting modules are designed so that you can start with a clearly defined package without long lead times and immediately receive output. Procedure: 1. Data docu
Our consulting modules are structured to allow you to commence with a clearly defined package without extensive lead times, delivering immediate results. Our procedure includes: 1. Data Documentation as a Service for directories and audit evidence. 2. Interim and Project Management for the operational control of complex undertakings. 3. Strategic Consulting for target vision, prioritization, and transformation roadmaps. 4. Digital Marketing and Data Protection Workshops for team alignment and training. 5. Systemic Coaching for leadership, conflict resolution, and effectiveness during periods of change. Depending on your specific requirements, each FAQ answer directly links to the appropriate module or product.
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
How to support departments that are apprehensive about data protection documentation?
Reduce complexity through templates, examples, and clear language. Highlight benefits: less audit stress, fewer inquiries, faster vendor onboarding. Conduct
Reduce complexity through templates, examples, and clear language. Highlight benefits: less audit stress, fewer inquiries, faster vendor onboarding. Conduct brief consultation sessions, jointly guide the initial entries, and provide feedback based on a checklist. Make it measurable: quality status, open items, lead time. Workshop and Enablement: /mein-shop/p/workshop-digitales-marketing
How do I plan a OneTrust rollout training for departments?
Build it as an enablement program: Fundamentals on purpose, legal basis, data categories, recipients, deletion, transfers, and TOMs. Afterwards, hands-on exercises in the tool
Build it as an enablement program: Fundamentals on purpose, legal basis, data categories, recipients, deletion, transfers, and TOMs. Afterwards, hands-on exercises in the tool based on real cases per department, with templates and a quality checklist. Supplement with cheatsheets, consultation hours, a review process, and spot checks to maintain quality after the training. Workshop Offer: /mein-shop/p/workshop-digitales-marketing
How do I integrate procurement and vendor onboarding into OneTrust processes?
Link procurement with data protection intake: no vendor go-live without minimal data, DPA status, hosting, sub-processors, transfer assessment, and TOM verification. Build
Link procurement with data protection intake: no vendor go-live without minimal data, DPA status, hosting, sub-processors, transfer assessment, and TOM verification. Build workflows for approvals, roles, and evidence storage. Implement standard questionnaires and mandatory documents. This prevents shadow processing. Services: /es/leistungen
Consulting & Next Steps
If this topic is relevant to your organization, you can book a suitable consultation or module directly.
How do I correctly assign legal bases when multiple purposes are involved in a single process?
Consistently separate purposes. A process can have multiple purposes, e.g., contract fulfillment, security, analysis, marketing. Assign the appropriate legal basis for each purpose
Consistently separate purposes. A process can have multiple purposes, e.g., contract fulfillment, security, analysis, marketing. Assign the appropriate legal basis for each purpose and document which data is necessary for it. If consent is required, describe consent gating and proof of consent. This way, you avoid contradictory documentation and impermissible mixing of purposes. Support: /mein-shop/p/datenschutzrechtliche-verarbeitung
Book now