Erdem Durmus
Managing Director | External Data Protection Officer
Erdem Durmus is Managing Director of NOTOS Xperts GmbH. He supports companies in classifying and implementing data protection requirements – from start-ups to large corporations. His focus is on operational consulting that does not end with recommendations, but actively supports implementation within the company.
As an appointed data protection officer, Erdem Durmus works for numerous companies. He advises clients particularly in the chemical, construction, IT, and services sectors as well as public-sector clients.
Before joining NOTOS Xperts, Erdem Durmus worked in the legal department of an international food company as well as in corporate data protection for a globally active airline. With several certifications in the data protection field (including multiple CIPP certifications from IAPP) and as the author of numerous publications, he combines a solid theoretical foundation with practical implementation experience.
Publications
Framework conditions and recommendations for data protection-compliant logging, DSB 2025, p. 58 et seq.
Privacy by Design and Privacy by Default: Is it all just a matter of settings?, DSB 2024, p. 236 et seq.
Data Protection Officer and AI Officer – an ideal symbiosis?, PinG 5.24, 237 et seq. (together with Georgia Voudoulaki)
The right to data portability – Application examples beyond social networks, DSB 2023, p. 203 et seq. (together with Nadya Kaplan)
GPS tracking of company vehicles, DSB 2023, p. 77 et seq.
Practical implementation of Transfer Impact Assessments (TIA), DSB 2023, p. 46 et seq.
The legality of processing representative and contact person data, DuD 03/2023, 160 et seq. (together with Jens Engelhardt)
Processing special categories of personal data based on a contract, DSB 2023, 7 et seq.
Controls of processors - Practical recommendations for dealing with and consequences from controls, DuD, 08/2022, 487 et seq. (together with Jens Engelhardt and Dr. Annika Selzer)
Commentary on Art. 22, 35, 36, 77, 78, 79, 80 GDPR and § 37 BDSG in Data Protection Law – A Commentary for Study and Practice, ed. Annika Selzer, Fraunhofer Verlag, 2022
Review and update of data protection measures according to Art. 24 GDPR, DSB 2020, 122 f. (p. 16 or p. 122)
Tasks, rights, and powers of the Data Protection Officer: a professional profile, DSB 2020, 35 f.
The GDPR-compliant deletion of emails - A pragmatic guide, Fachhochschulverlag, Frankfurt am Main, 2020
The difference between legitimate interest and the purpose of processing, DSB 2020, 12 f.
Support obligations of the processor towards the controller, DSB 2019, 273 f.
Subject and purpose of Controller-to-Controller agreements, DSB 2019, 129 f.
The calculation of fines according to Art. 83 GDPR: Group revenue or revenue of a single company?, DSB 2019, 94 f.
The group data protection officer under the GDPR – A pragmatic representation, LR 2019, 13 et seq.
Practical implementation of transparency obligations, RDV 6/2018, 297 et seq.
The right to data portability, RDV 2/2018, 80 et seq.
