GDPR Compliance Check for Animal Professions

Mandatory for everyone who processes personal data – including solo entrepreneurs. In audits, this is the first thing the authority wants to see.

List all data flows: Contact form → Email provider → CRM. Per processing activity: purpose, legal basis, retention period, recipients. Templates are available at WKO (AT), BfDI (DE), FDPIC (CH).

Every data processing activity requires one of 6 legal bases (Art. 6 GDPR). Without proper assignment = risk of fines.

Customer contract → Art. 6(1)(b). Newsletter → Consent Art. 6(1)(a). Tax documents → legal obligation Art. 6(1)(c). Write it into the records of processing activities.

You are not allowed to store data forever. Tax documents: 7 years (AT/DE) or 10 years (CH). Marketing data: only as long as consent remains valid.

Simple plan: Which data? How long? When deleted (automatically/manually)? Set a reminder in the CRM or a yearly cleanup in the calendar.

If Brevo, Mailchimp, Google Workspace, Calendly etc. process your customer data, you need a Data Processing Agreement (DPA).

For every service: Account-Settings → Privacy/DPA. Usually a one-click PDF download. Collect all in a folder named 'DPA Contracts'.

Mandatory in AT (§5 ECG, §25 MedienG), DE (§5 DDG formerly TMG) and CH (Art. 322 OR/UWG). Without a legal notice: risk of warning letters from day one.

Name, address, email, phone, VAT ID, professional title, supervisory authority if applicable, dispute resolution link (EU). Generator e.g. from WKO or e-recht24.

Mandatory according to Art. 13/14 GDPR. Must list all tools that process data (hosting, analytics, fonts, maps, social plugins).

List every tool individually. Update at least once a year. Add new tools immediately. Generators: e-recht24, datenschutz-generator.de, WKO.

Tracking cookies (analytics, pixels, maps) require active consent BEFORE they load. 'Continuing to browse = consent' is illegal.

Tools: Cookiebot, Borlabs, Usercentrics, Klaro!. Buttons same size: 'Accept all' = 'Reject all'. No pre-ticked checkboxes.

Mandatory as soon as you have any form. Without HTTPS: Browser warning + GDPR violation (Art. 32 – Data security).

Free today at every host via Let's Encrypt. WordPress: 'Really Simple SSL' plugin. Force domain to https:// (301 redirect).

External Google Fonts send visitor IPs to Google in the USA. AT/DE courts consider this a GDPR violation (see Regional Court Munich I 2022).

Download fonts (google-webfonts-helper.herokuapp.com), host locally, integrate @font-face. Or use system fonts.

Google Analytics without consent = risk of fines. IP anonymization, EU servers, DPA and opt-in are mandatory.

Alternative: Plausible, Matomo (self-hosted), Pirsch – cookie-less & GDPR-friendly. Otherwise load GA4 only after cookie consent.

Protects you from disputes over scope of service, cancellation rules, and liability. Courts only accept what is fixed in writing.

Min.: service, price, duration, cancellation periods, liability waiver (animals are not objects according to §285a ABGB/§90a BGB). Have signed before first contact.

T&Cs only apply if the customer could have known them AND agreed to them. Otherwise, only statutory rules apply (often worse for you).

Link T&Cs on website + contract clause: 'The T&Cs at URL apply, which the customer has acknowledged.' Have them check a box actively.

Animal data + owner info are personal data. WhatsApp chats, loose papers, or unprotected cloud folders = violation of Art. 32 GDPR.

Encrypted CRM account with 2FA. For local files: disk encryption (BitLocker, FileVault). No sharing via private WhatsApp.

Customers may request information (Art. 15) or erasure (Art. 17) at any time. You must respond within 1 month.

Prepare a standard email: 'You can receive information at dsgvo@your-domain.at. Response within 30 days.' Test full-text search by email/name in the CRM.

In case of a data leak, you must inform the supervisory authority within 72h (Art. 33 GDPR). Delay = fine in addition to damages.

Note: Which authority? AT: dsb.gv.at, DE: BfDI/state authority, CH: edoeb.admin.ch. Emergency checklist in desk drawer.

Without provable consent = spam = up to €50,000 fine (TKG AT/DE). Single opt-in or pre-entered addresses are illegal.

Tool like Brevo/Mailchimp: activate DOI function. Confirmation link + storage of date/IP. Unsubscribe link in EVERY email.

WhatsApp Business is allowed. BUT: You need a DPA with Meta + notice in the privacy policy + customer consent.

WhatsApp Business API via certified provider (e.g. 360dialog, MessageBird). NEVER use private WhatsApp for customer data.

Also Instagram, Facebook, and TikTok business profiles need a legal notice or a link to it. Monitoring is increasing.

In bio: 'Legal Notice: your-domain.at/impressum'. On Facebook: info section. Acceptance of Linktree is disputed – a direct link is safer.

Fake reviews, healing promises, or comparative advertising can be expensive (UWG: warning letter + damages).

Only real customer testimonials with consent. No healing promises ('cures arthrosis'), but experience reports. Comparative advertising: only factually proven.

Animal photos are usually OK. But: Owner recognizable + voice + training grounds + home = personal data = consent required.

Standard form: Which images? Where published (Website, Instagram, advertising)? Revocable at any time. Sign before the photo session.

For children under 16 (DACH), parental consent is sufficient. Violation = particularly high risk of fines.

Have both legal guardians sign. For family celebrations/workshops, post a photo notice at the entrance ('Photos are being taken – please talk to us').

Simply using Google images = copyright infringement = warning notice (€300–2,000 per image). Music in Reels also needs a license.

Sources: Pexels, Unsplash (CC0), or paid Adobe Stock, Shutterstock. Save the license. Music: Use Instagram/TikTok's own library.

Since Schrems II, data transfer to the USA is only permitted with additional guarantees (SCC + TIA). Pure 'Privacy Shield' is dead.

In the DPA of US tools (Google, Meta, Stripe etc.): SCC module must be included. For critical data: check EU alternatives (Brevo instead of Mailchimp).

'Dog123' for 5 tools = one leak and all accounts open. Duty of 'appropriate security' according to Art. 32 GDPR.

Bitwarden (free), 1Password, Dashlane. Master password + 2FA. Random password generated for each tool.

Data loss = you can no longer provide information + customers are gone. Cyber insurers require a backup concept.

3 copies, 2 media, 1 external. Cloud backup (encrypted) + external hard drive. Test restore monthly.

In case of a data leak: Lawyer, forensics, authority communication, damages – quickly reaching 5 figures. Professional liability usually doesn't cover this.

Modules: First-party damage, third-party damage, cyber extortion, crisis PR. Providers: HDI, Allianz, Hiscox. From ~€25/month for solo entrepreneurs.

Employees see customer data, animal medical records, payment data. Without an NDA, you are liable for their chatter.

Standard NDA + GDPR commitment declaration (Art. 29 GDPR). 1 page, sign before starting work. Template from WKO/IHK.

You must prove that your team knows how to handle customer data. A random sample is not enough for the authorities.

30 min. initial training + annual refresh. Topics: Passwords, USB ban, plain text emails, reporting data breaches. Have attendance signed.

Austria has its own DSG in addition to the GDPR with special rules (e.g. image recordings §12 DSG, criminal law §63 DSG).

For practice cameras: notice + consent mechanism. Supervisory authority: Data Protection Authority Vienna (dsb.gv.at).

Germany supplements GDPR with BDSG. Important: §38 BDSG – Data protection officer for 20+ people who regularly process data.

Solo entrepreneurs are usually not affected. Supervisory authorities per federal state (e.g. LDA Bayern, BlnBDI Berlin). TTDSG for cookies since 2021.

Switzerland has its own data protection law – similar but not identical to the GDPR. Applies to everyone with Swiss customers.

Record of processing activities (CH-term) instead of GDPR term. Privacy policy CH-specific. Supervision: FDPIC (edoeb.admin.ch).