External service providers for data protection and compliance?

Author: Stephanie Simon-Sommer, lawyer

The world we live in is becoming increasingly complex. Companies have to navigate an ever-growing thicket of laws and regulations. Their legal departments are expected to clear a path, with every legal matter landing on their desks. Yet dealing adequately with every task is becoming increasingly difficult. For one thing, the shortage of skilled professionals has long since reached in-house legal departments, which often lack the staff to handle new assignments. This is one reason why workloads in many legal departments have reached a level at which “pressure” has become “overload”. For another, in-house lawyers are often burdened with routine tasks that fill the working day to bursting point while keeping them from genuinely important — that is, strategically relevant — processes and projects. These tasks also sap motivation and encourage thoughts of leaving. So what can be done?

Let us frame the question differently and focus on the solution: why do everything yourself? Why not delegate certain tasks to external service providers? Legal outsourcing is generally an attractive option for companies seeking to deploy their legal department as efficiently as possible. These service providers

• take on routine tasks such as reviewing NDAs or contracts.
• are brought in temporarily to absorb peaks in workload.
• step in as interim staff (for example, to cover parental leave).

In our increasingly complex world, legal outsourcing can perform other important tasks too. Data protection is one. Compliance is another. Requirements in both areas are becoming ever more complex. But is it worthwhile, particularly for medium-sized companies, to build the relevant expertise in-house? Especially at a time of skilled labour shortages? Or is it more efficient and cost-effective to “buy in” this expertise externally?

External service providers for data protection

Clarius.Legal is one such external service provider. Our services include data protection audits, enabling companies to identify weaknesses in their business processes quickly and comprehensively. For those wishing to go one step further, we offer modular data protection management that allows companies to automate and prioritise time-consuming processes at the same time. Uncertainty about responsibilities and communication becomes a thing of the past.

Alternatively — or additionally — companies can appoint an external data protection officer to handle all legal challenges relating to data protection. Clarius.Legal naturally offers this service as well. Companies choosing the external solution do not need to train their own employees and can deploy them on their core tasks. External data protection officers also benefit a company’s public image: they demonstrate how much importance the company attaches to up-to-date data protection. This builds trust, including with supervisory authorities.

External service providers for compliance

While companies have recognised the importance of data protection at least since the GDPR was introduced, the value of compliance is still often underestimated. That is now changing, not least because of the requirements of the CSRD. The European Union’s Corporate Sustainability Reporting Directive requires around 15,000 of Germany’s largest companies to prepare sustainability reports in accordance with defined requirements. The aim is to achieve international comparability similar to that of financial reports. The CSRD’s understanding of sustainability is not limited to reducing CO2 emissions and recycling; it regards social factors as just as important as governance, meaning corporate management. Convincing compliance is at the heart of good corporate governance. In other words, compliance is increasingly moving from a “nice to have” to a “must have”.

Here too, the question arises: must this expertise be built in-house, or does an external service provider make more sense? Clarius.Legal advises on everything from individual compliance measures to establishing a complete compliance management system. If requested, Clarius.Legal provides an external compliance officer responsible for ensuring legally compliant action amid increasing regulatory density and for preventing losses. This allows companies to benefit from lawyers’ duty of confidentiality and effectively prevent conflicts of interest.

The principle is: “Outsource the work that keeps you from working.” This allows employees in the legal department to focus on work that genuinely adds value.