Verena Grentzenberg

She/herPartner

Excellent expert in data protection law as well as calm and level-headed crisis manager.

— Competitor, JUVE Handbook

About

Areas of FocusFinancial Services Industrials Insurance Life Sciences Media Sports and Entertainment Technology Real Estate Intellectual Property

Professional QualificationsRechtsanwältin admitted with Hanseatische Rechtsanwaltskammer Hamburg

EXPERIENCE

Advising the developer and operator of a nationwide, large-scale eGovernment project incorporating AI components on data protection, AI and digital regulation. Key areas of work included ‘privacy by design’ concepts, data protection documentation, regulatory strategy and supporting consultations with ministries and supervisory authorities.
Advising a global life sciences company on the implementation of a worldwide consent management programme across more than 50 jurisdictions. Key areas included the development of a global governance and compliance framework, the drafting of country-specific consent requirements, and the coordination of an international project involving a technical implementation partner, legal project management and legal delivery centre.
Advising companies on data protection requirements relating to the use of artificial intelligence, including support for AI sandbox projects, AI governance structures, data protection impact assessments and ‘privacy by design’ concepts.
Advising a global manufacturer of commercial vehicles on the data protection implications of the Data Act for connected products.
Advising an automotive manufacturer on a new business model in the field of digital services.
Advising a software company on a project to anonymise patient data for research and analysis purposes, including the assessment of technical measures and coordination with a data protection supervisory authority.
Providing regular advice to national and international companies on cyber-attacks and data security incidents, including crisis management, coordination with forensic and incident response teams, compliance with regulatory requirements, and communication with authorities and other stakeholders.
Strategic advice on (cyber) incident related damage claims, including the development of defence strategies and the management of large-scale consumer claims.
Advising national and international companies on the requirements of NIS2, including scope assessments, compliance obligations, support during cyber security incidents and assistance with regulatory reporting procedures.
Leading the advisory work for a company in a security-critical sector on a global data protection and cybersecurity compliance programme, including the development and implementation of international governance structures, group-wide policies and the coordination across numerous jurisdictions.
Leading a global data protection analysis for the roll-out of a human resources information system for a listed company across more than 90 countries.
Advising multinational companies on international data transfers under the Schrems II ruling, including transfer impact assessments and group-wide transfer governance.
Representing an online marketplace in a test case brought by a consumer protection organisation regarding the data protection law compliance of its business model, in particular with regard to the requirements of data minimisation and the necessity of processing.
Leading an international project to introduce telematics solutions in company vehicles in more than 15 countries, taking into account data protection and employment law requirements.
Advising a US life sciences company on the data protection requirements for market entry in Europe, including the structuring of international data flows, marketing activities and compliance requirements within a regulated environment.
Representing an industrial company in administrative fine proceedings concerning the processing of health data, including an internal investigation and the redesign of processes.
Providing strategic advice to companies on complex data subject access requests under the GDPR, including conducting test cases on the applicability of civil procedural instruments such as affidavits in connection with data subjects’ rights under data protection law.

Languages

Awards & Recognitions

Education

IT management assistant, Chamber of Commerce Hamburg, 1994

University of Hamburg, First State Examination, 2000

Post graduate program „Law and Economics“, Hamburg

Higher Regional Court, Hamburg, Second State Examination, 2004

Publications

Seminars

Einsatz von KI bei internen Untersuchungen und behördlichen Ermittlungen, Chief Compliance Officer Kongress, 24 September 2025
DSGVO-Schadensersatz: Risikomanagement nach BGH-Urteil zu Facebook Scraping, 21 January 2025
So meistern Sie Auskunftsverlangen nach DSGVO, 30 January 2024
DLA Piper GDPR Fines and Data Breach Survey 2024 - webinar, 18 January 2024

Prior Experience

Prior to joining DLA Piper Verena worked with two different international law firms in Hamburg (2004 - 2011 and 2011 - 2015) as well as IT Consultant and software developer for international transport and logistics companies.

Additional Information

Verena Grentzenberg has taught online data protection law at the Hamburg Media School for many years and, since the summer term of 2024, gives an annual lecture titled ‘Employee Data Protection in the Digital World’ at Bucerius Law School in Hamburg.

Memberships And Affiliations

German Association for Law and Informatics e.V. (DGRI)
Alumni Club of the German National Merit Foundation (Studienstiftung des deutschen Volkes)
German Youth for Understanding Committee (YFU)