Hamburg
+49 40 35 52 80-980 +49 40 35 52 80-80 m.wulf@heuking.de
Languages
German,
English
Practice groups/Expertise
Consulting focuses
- Information Technology (IT)
- Data Protection Law
- IT-Outsourcing Tech-driven transactions
- Cyber Security
- Open Source Projects
Vita
- Certified Specialist Lawyer in Information Technology Law
-
ISO 27001 Auditor (TÜV)
- Admitted to the bar since 2000
- Education and former activities
- SKW Schwarz 2013-2018
- Praetoria Rechtsanwälte 2009-2013
- Promotion (PhD) at University of Hamburg 2003
- Wulf & Laabs Rechtsanwälte 2000 bis 2009
- Legal clerkship at Higher Regional Court Schleswig 1998-2000
- Law studies at University of Hamburg 1991-1998
Affiliations
- Deutsche Gesellschaft für Recht und Informatik e. V. (DGRI)
- International Bar Association (IBA)
- Deutscher Anwaltsverein (DAV)
- Rotary International
- World Service Group (WSG)
- International Association of Privacy Professionals (iapp)
Dr. Hans Markus Wulf's Distinctions
Legal 500 Deutschland 2025
Handelsblatt: Deutschlands beste Anwälte 2025
Best Lawyers 2026
JUVE Handbuch Wirtschaftskanzleien 2024/2025
Leaders League 2024
Handelsblatt: Deutschlands Beste Anwälte 2024
Best Lawyers 2025
Legal 500 EMEA 2024
Legal 500 Germany 2024
kanzleimonitor 2023/2024
Best Lawyers 2024
Handelsblatt: Deutschlands Beste Anwälte 2023
Leaders League 2023
Leaders League 2023
Legal 500 Germany 2023
kanzleimonitor 2022/2023
Handelsblatt: Deutschlands Beste Anwälte 2022
Handelsblatt: Deutschlands Beste Anwälte 2022
Best Lawyers 2023
kanzleimonitor 2021/2022
Best Lawyers 2022
Handelsblatt: Deutschlands Beste Anwälte 2021
Handelsblatt: Deutschlands Beste Anwälte 2021
Legal 500 EMEA 2021
Legal 500 Germany 2021
Handelsblatt: Deutschlands Beste Anwälte 2020
Best Lawyers 2021
Legal 500 EMEA 2020
Legal 500 Deutschland 2020
Handelsblatt: Deutschlands Beste Anwälte 2019
Best Lawyers 2020
Latest news
Gallery
Publications
2025
EU DIGITAL LAW: What legal obligations will providers of SaaS (Software as a Service) services face in the future?
Update Data Protection No. 224,
together with
Theresa Marie Bardenhewer, LL.M.
Digital Omnibus: What changes in data protection (GDPR) can be expected?
Update Data Protection No. 223,
together with
Theresa Marie Bardenhewer, LL.M.
Digital Omnibus: EU Commission presents draft
Update Data Protection No. 221, November 13, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
AI ACT: Should ChatGPT be classified as High-Risk AI?
Update Data Protection No. 220, October 28, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
EU DIGITAL LAW: Will there be an extension of the deadline for the implementation of the AI Act, the Data Act, and the Cyber Resilience Act (Digital Omnibus)?
Update Data Protection No. 219, October 15, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
DATA ACCESS WITHIN THE COMPANY GROUP: Are companies permitted to access the IT systems of parent, sister, or subsidiary companies?
Update Data Protection No. 218, October 1, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
New draft bill for the implementation of the AI Regulation
Update Data Protection No. 217, September 24, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Legal framework for the use of AI AGENTS
Update Data Protection No. 215, September 17, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Data Act: New obligations for data disclosure apply from September 12
Update Data Protection No. 214, September 11, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
EuG confirms effectiveness of EU-US Data Privacy Framework
Update Data Protection No. 219, September 3, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
The new EU Digital Identity Wallet (EUDI)
Update Data Protection No. 218, July 21, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Neue Pläne der EU-Kommission: Der Digital Networks Act
Update Data Protection No. 217, July 16, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Digital accessibility: What companies have to consider since June 28, 2025
Update Data Protection No. 216, July 9, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
E-Evidence Regulation: New obligations for service providers from 2026
Update Data Protection No. 215, July 8, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
New guidance from the Data Protection Conference on the legally compliant use and development of AI systems
Update Data Protection No. 214, July 1, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
EUR 45 million GDPR-fine against Vodafone – What are the conclusions for EU-companies?
Update Data Protection No. 212, June 12, 2025,
together with Dr. Hans Markus Wulf, Theresa Marie Bardenhewer, LL.M. and Emily Bernklau
New plans from the EU Commission: The Digital Fairness Act
Update Data Proctection No. 211, May 23, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Artificial Intelligence: These Transparency Obligations must be observed
Update Data Protection No. 208, May 7, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Cybersicherheit: NIS-2 im Gesundheitssektor – Was die EU-Richtlinie für Krankenhäuser bedeutet
Klinik Einkauf, April 2025, pp. 37-39
New developments in EU Digital Law
Update Data Protection No. 207, May 5, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
Use of US Cloud Providers under the Trump Administration: Risks and Recommendations for Action for Companies
Update Data Protection No. 206, April 15, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
GDPR compliance when using ChatGPT & Co.
Update Data Protection No. 204, April 3, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
EU Regulation on the European Health Data Space (EHDS) published
Update Data Protection No. 202, March 6, 2025,
together with
Theresa Marie Bardenhewer, LL.M.
The Data Act: Opportunities and challenges for companies
Update Data Protection No. 200, February 25, 2025,
together with
Dr. Thomas Jansen
EU digital law 2025 – These innovations should be considered
Update Data Protection No. 197, January 3, 2025
2024
Europäischer Datenschutzausschuss veröffentlicht Stellungnahme zum Einsatz von KI-Modellen
Update Data Protection No. 196, December 20, 2024,
together with
Julian Rosenfeld
New accessibility requirements: Affected companies must revise their websites by June
Update Data Protection No. 193, November 27, 2024
Data protection supervision: Failure to delete personal data leads to a fine of EUR 900,000
Update Data Protection No. 192, November 15, 2024
Draft bill of the Employee Data Protection Act (BeschDG): New regulations for the use of artificial intelligence in the employment relationship
Update Data Protection No. 190, November 4, 2024,
together with
Antje Münch, LL.M.
AI Act: Erste gesetzliche Pflichten greifen ab Februar 2025
Interview, HH@WORK: Der AI Act und seine Auswirkungen auf Unternehmen, Newsletter, Oktober 16 2024
Künstliche Intelligenz: Diese gesetzlichen Pflichten greifen bereits ab Februar 2025
Update Data Protection No. 185, September 30, 2024,
together with
Dr. Johannes Rolfs, LL.M.
Die KI-Verordnung kommt noch vor der Sommerpause – Hat der Zeitdruck wertvolle Qualität gekostet?
Recht der Internationalen Wirtschaft, Issue 8, August 2, 2024
NIS2 Directive: Update on the German Implementation Act
Update Data Protection No. 183, July 30, 2024,
together with
Michael Kuska, LL.M., LL.M.
, Manuel Poncza
NIS2 Directive: Update on the German Implementation Act and the new EU Implementing Regulation
Update Data Protection No. 180, July 2, 2024,
together with
Michael Kuska, LL.M., LL.M.
Data protection compliant use of artificial intelligence – Data protection authorities publish guidance
Update Data Protection No. 178, May 14, 2024,
together with
Antje Münch, LL.M.
Data Protection & Cybersecurity – Germany
The Legal 500 Country Comparative Guide 2024
Ein Überblick zum Status Quo der EU-Digitalstrategie und rechtliche Auswirkungen auf die Privatwirtschaft
Zeitschrift für das Recht der digitalen Wirtschaft, Issue 4, pp. 118-124
EU digital law: Formal agreement in the EU Parliament on the AI Regulation, the Cyber Resilience Act and the European Media Freedom Act
Update Data Protection No. 173, March 13, 2024,
together with
Manuel Poncza
AI Act: Preliminary result of the trilogue negotiations leaked
Update IP, Media & Technology No. 90 & Update Data Protection No. 168,
together with
Dominik Eickemeier
E-Evidence Act: Herausgabe- und Prüfpflichten für Anbieter von Onlinediensten in europaweiten Strafverfahren
Update Data Protection No. 166, January 12, 2024,
together with
Dr. Johannes Rolfs, LL.M.
2023
DORA – One year before the implementation deadline, more and more details are becoming known
Update Data Protection No. 164, December 21, 2023,
together with
Dr. Johannes Rolfs, LL.M.
AI Act (update): Agreement on the new AI regulation
Update Data Protection No. 162, December 14, 2023
Cyber Resilience Act: Vorläufige Einigung von Rat und Parlament, fünfjährige Updatepflicht und längere Umsetzungsfrist
Data Protection Update No. 160, December 7, 2023,
together with
Dr. Johannes Rolfs, LL.M.
Data Act (Update): EU Parliament adopts new data law, what steps do companies need to implement now?
Update Data Protection No. 158, November 23, 2023
Differing views of German regulators on the effectiveness of the Data Privacy Framework (use of U. S. cloud services)
Update Data Protection No. 153, September 14, 2023
Supervisory authority provides guidance on implementing the new Data Privacy Framework
Update Data Protection No. 152, August 18, 2023
DATA ACT: Europäisches Parlament einigt sich auf ein Datengesetz mit weitreichenden Rechtsfolgen für Unternehmen
Update Data Protection No. 148, July 5, 2023,
together with
Dr. Johannes Rolfs, LL.M.
Rechtliche Aspekte bei der digitalen Transformation nicht vergessen!
Security-Insider, 28. Juni 2023
Künstliche Intelligenz: Europäisches Parlament macht Weg frei für neue EU-Verordnung (AI-Act)
Update Data Protection No. 146, June 26, 2023,
together with
Dr. Johannes Rolfs, LL.M.
Current developments in international data transfer - New guideline of the supervisory authorities & record fine against META
Update Data Protection No. 143, May 31, 2023,
together with
Dr. Johannes Rolfs, LL.M.
Data Protection & Cybersecurity - Germany
The Legal 500 Country Comparative Guide 2023
Digital Operational Resilience Act and Cyber Resilience Act: New EU requirements for cybersecurity
Update Data Protection No. 132, February 13, 2023,
together with
Dr. Johannes Rolfs, LL.M.
2022
Current legal situation regarding the use of tracking tools on websites
Update Data Protection No. 128
Der Digital Services Act: Erste Pflichten sind schon bis Februar 2023 umzusetzen
Update Data Protection No. 127
Microsoft 365 and Data Protection: US Data Transfer is Inadmissible, Consent is Invalid
Update Data Protection No. 125
Die neue EU-Verordnung zur Künstlichen Intelligenz – Inkrafttreten schon Anfang 2023 möglich
Update Data Protection No. 121
OLG Karlsruhe stellt klar: Einsatz eines europäischen Server- und Hosting-Dienstleisters mit US-amerikanischer Konzernmutter nicht per se datenschutzrechtlich unzulässig
Update Data Protection No. 116
Das neue EU-Digitalrecht und seine Umsetzung in Deutschland
Update Datenschutz No. 114
“In Germany the authorities are taking increasingly consistent action against IT security breaches.”
Leaders League, July 29, 2022
Supervisory Authority Publishes Guidelines for the Implementation of Erasure Obligations under the GDPR
Update Data Protection No. 113,
together with
Dr. Johannes Rolfs, LL.M.
DATA PROTECTION & CYBER SECURITY LAW Germany
The Legal 500, Country Comparative Guides
2021
Verwaltungsgericht untersagt Nutzung von Consent-Management-Plattform „Cookiebot“ mit weitreichenden Folgen für den internationalen Datentransfer
Update Data Protection No. 106
Drittlandtransfers nach Schrems II – Europäischer Datenschutzausschuss aktualisiert Empfehlungen
Der Betrieb, page 1524, July 12, 2021
New EU Standard Contractual Clauses in Force - How Companies should now correctly proceed when using US Cloud Services
Aufsichtsbehörden beschließen Datenschutzkontrollen bei Unternehmen, insbesondere zum internationalen Datentransfer; neue Standardvertragsklauseln der EU-Kommission
Update Data Protection No. 98
EU Data Protection Officer Initiates Proceedings against Institutions of the European Union for using Amazon AWS and Microsoft Office 365
Update Data Protection No. 97
E-Privacy-Richtlinie endlich umgesetzt – Bundestag beschließt Neuregelung des Datenschutzes im Bereich der Telemedien und Telekommunikation
Update Data Protection No. 96
Framing bei technisch geschützen Werken nur mit Erlaubnis des Urhebers
dfv Mediengruppe, Kommunikation & Recht, 05/2021, S. 303
Right to copy of personal data: First highest court ruling on the right of access to information under data protection law pursuant to Article 15(3) GDPR issued (Federal Labor Court, April 27, 2021)
Update Data Protection No. 95
EuGH: Framing kann eine Urheberrechtsverletzung darstellen. Was Unternehmen nun beachten müssen.
Update IP, Media & Technology No. 36
Bußgelder nur noch nach Datenschutzverstößen von Führungskräften? Das Urteil des LG Berlin vom 18. Februar 2021
Update Datenschutz Nr. 92
German Cyber Security Act 2.0: Federal Cabinet presents new draft
Update Data Protection, No. 90
Update on the Legal Situation for Data Transfer to Third Countries (the US and China in particular)
Update Data Protection, No. 89
Lectures
2025
Countdown Data Act: Überblick, Umsetzungsinhalte und Praxisfälle
26. Datenschutzkongress, Handelsblatt, May 14, 2025, Berlin,
together with
Dr. Thomas Jansen
2024
Update Künstliche Intelligenz im Unternehmen
Inhouse-Event, October 9, 2024, Hamburg
NIS-2-Richtlinie & E-Evidence Act
Inhouse-Event with nGENn GmbH, July 11, 2024
DSA: Welche Pflichten treffen Unternehmen durch den neuen Digital Services Act?
GDD (Gesellschaft für Datenschutz und Datensicherheit e.V.), 156. ERFA Kreis Nord, July 4, 2024, Hamburg
Cyber Resilience Act
24. Datenschutzkongress, Handelsblatt, May 23, 2024
Update zur KI-Verordnung
Heuking Compliance Day, April 11, 2024
DORA-Verordnung
kreuzwerkern, February 29, 2024
Neue KI-Verordnung
EO (Entrepreneur Organisation), February 13, 2024
2023
Recht der Cybersecurity – Status Quo und aktuelle Gesetzesvorhaben
deutsche ict + medienakademie, Februar 8, 2023
2022
DSGVO, Schrems, Cloud Act und Co. – Worauf Behörden bei der Digitalisierung bauen können
1&1 IONOS, November 4, 2022
2021
2020
Daten im Betrieb rechtskonform verarbeiten
Handelskammer Hamburg, September 24, 2020
Kein Privacy Shield mehr – sind Standardvertragsklauseln ein Ausweg?
1&1 IONOS, September 17, 2020
2019
Datenschutzgrund-Verordnung und E-Privacy-Verordnung
Handelskammer Hamburg, October 22, 2019
Cybersicherheit & Recht – Rechtliche und technische Anforderungen für Unternehmen
WM Gruppe, 21. Compliance-Tagung, 19. September 2019
Cybercrime: Wie kann ich mich schützen?
Handelskammer Hamburg und das Kompetenzzentrum Hamburg, September 3, 2019
Cybersicherheit & Recht - Überblick und Praxishinweise zu den rechtlichen und technischen Anforderungen
Veranstaltung der Handelskammer Hamburg, June 18, 2019, Hamburg