Data protection identified as a strategic leadership priority in Germany

Data protection in German companies is increasingly being recognized as a strategic management responsibility rather than a purely technical or legal task. According to the 2026 sentiment report from the Stiftung Datenschutz, nearly half of German executives view data protection as a strategic location factor, yet one-third of companies still report a high need for action.

Experts emphasize that data protection must be integrated into corporate governance to be effective. Thomas Vini Pires of the EQS Group notes that while many companies treat data protection as an isolated IT or legal issue, it is actually a leadership task. A critical point of concern is legal liability; under Article 38 of the GDPR, while a Data Protection Officer has a direct reporting line to management, the legal responsibility remains with the company leadership.

Practical failures continue to occur at the operational level. In one documented case, a medium-sized company left a physical directory containing the personal data and private mobile numbers of approximately 250 employees unattended at an unsecured reception desk. This incident highlights that data security risks often stem from everyday processes and physical access rather than just complex IT systems.