Data privacy is often heavily regulated and is followed by political and judicial disputes about its interpretation. Many questions are still open and subject to future developments. On the other hand, if companies want to act in a compliant way, they need to set clear rules fort he processing of data. Where are the quick wins in such decisions and where should we prepare for better solutions?