ISiCO Datenschutz

What ISiCO Datenschutz does

ISiCO GmbH is a Berlin-based German management consultancy specializing in data protection, information security, AI governance, and data strategy. The firm serves a mixed client base that includes SMEs and hidden champions, DAX-listed corporates and corporate groups, technology and digital platform companies, and public sector and critical infrastructure operators. Its core service portfolio spans external Data Protection Officer and external Information Security Officer mandates, data protection and IT security audits, ISMS implementation (including NIS2, ISO 27001, and TISAX variants), DORA and Cyber Resilience Act advisory, ISO 42001 AI management certification, external AI officer services, data strategy maturity assessments, whistleblower protection implementation, and EU representative services under GDPR Article 27.

Underlying the consulting practice is a group of proprietary technology assets owned by the same founding group: caralegal, a SaaS platform for data protection and AI management compliance workflows, and lawpilots, an e-learning platform for regulatory training. These platforms are integrated into consulting engagements and are also sold as standalone or bundled SaaS subscriptions, enabling a consulting-plus-software delivery model. ISiCO co-founded the group with Schürmann Rosenthal Dreyer Rechtsanwälte, a technology and data law boutique, providing in-house legal expertise.

ISiCO operates from offices in Berlin (headquarters), Köln, and München, serving clients across Germany and internationally via remote delivery. Revenue is generated through professional services (project-based and retainer consulting, fixed-price ISMS packages), recurring SaaS subscriptions (caralegal, lawpilots), and ticketed events including the DuD conference in Berlin (regular ticket €1,995), Datenschutztag Köln, and Cybersicherheitstag Köln. The firm is founder-led by Simone Rosenthal and Kathrin Schürmann, with Dr. Jan Scharfenberg (Managing Director, Information Security) and Jacqueline Neiazy (Managing Director, Data Protection) leading practice areas.

Name

ISiCO Datenschutz

Legal name

ISiCO GmbH

Website

https://isico-datenschutz.de

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

11–50 employees

Short description

ISiCO GmbH is a Berlin-based German management consultancy delivering data protection, information security, AI governance, and data strategy services to SMEs, DAX corporates, tech firms, and the public sector, complemented by its proprietary SaaS platforms caralegal and lawpilots.

Ownership category

akta.pro rank

Product category

Data Protection & Information Security Consulting

NAICS

Management Consulting Services (54161), Management, Scientific, and Technical Consulting Services (5416)

SIC

Services-Management Consulting Services (8742), Services-Engineering, Accounting, Research, Management (8700), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Compliance Technology, GRC Platforms & Controls Automation Advisory (BPAHAFAO)

akta.pro secondary industries

IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK), ITSM Governance, Compliance & Audit Readiness (BPAEAJAM)

Keywords

• Data protection consulting
• Information security consultancy
• GDPR compliance services
• ISO 27001 certification
• AI governance advisory

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D, Infrastructure

Revenue model

1. Professional Consulting Services: Bespoke consulting engagements for data protection, IT security, AI compliance, and data strategy. Delivered by experienced consultants and technology experts. Engagement typically begins with a free initial consultation, followed by project-based or retainer-based consulting work. Fixed-price service packages (e.g., ISMS service packages) are also offered.
2. caralegal & lawpilots Software Platforms: ISiCO is part of a company group that developed and markets caralegal (data protection management software) and lawpilots (regulatory e-learning). These SaaS platforms generate subscription revenue and are integrated into the consulting offering.
3. Conference & Event Tickets: ISiCO is the official organizer of the DuD (Datenschutz und Datensicherheit) conference, Cyber Security Day, and Data Protection Day. Revenue is generated through paid conference tickets and webinar participation fees.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels6 records

Core offering

ISiCO GmbH is a German management consultancy that delivers bespoke data protection, information security, AI governance, and data strategy consulting to enterprises, SMEs, and public sector organisations. The firm supplements its consulting with two proprietary SaaS platforms from the same company group — caralegal (data privacy / compliance management software) and lawpilots (regulatory e-learning) — and runs industry conferences (DuD, Datenschutztag, Cybersicherheitstag). Engagements begin with a free non-binding 15-minute consultation and are delivered as customised projects or fixed-price ISMS service packages.

Product overview

ISiCO is a German management consultancy specializing in data protection, information security, AI, and data strategy. The company offers a comprehensive portfolio of consulting services rather than a unified software platform. The core service areas include Data Protection Consulting (covering DPIA, ROPA, employee data protection, data breaches, and compliance management), IT Security services (including External Information Security Officers, ISMS implementation for NIS2/ISO 27001/TISAX, ransomware protection, IT forensics, and risk management), AI Consulting (ISO 42001 certification and External AI Officer services), and Data Strategy (maturity assessments, data governance, and data product consultancy). The company also offers two proprietary software products: caralegal, a data responsibility platform for privacy compliance management, and lawpilots, an e-learning platform for regulatory training. Additional offerings include workshops, DPO coaching, EU Representative services under GDPR Art. 27, and Whistleblower Protection Act implementation. ISiCO positions itself as customized and business-oriented, avoiding standardized one-size-fits-all solutions.

Differentiator

Problem solved

Functional benefit

Named customers8 records

Segments5 records

Ideal customer profiles4 records

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature2 records

Partnerships

Six partnerships are on record, tiered core and minor.

• caralegalcoreTechnology or Integrationcaralegal is a proprietary data responsibility platform developed by the ISiCO group of companies. It simplifies fulfilment of data protection requirements, bringing all compliance aspects into one comprehensive software tool. ISiCO integrates caralegal into its consulting engagements as the technology component of its 360° solution.
• lawpilotscoreTechnology or Integrationlawpilots is a proprietary e-learning platform developed by the ISiCO group of companies, described as the market leader in regulatory training with content as engaging as a Netflix series. ISiCO integrates lawpilots into its training and employee awareness offerings as part of its 360° solution.
• Schürmann Rosenthal Dreyer RechtsanwältecoreStrategic or Co-development PartnerA technology, data, and AI law firm that co-founded the ISiCO group of companies with its founders (Kathrin Schürmann, Simone Rosenthal). Provides legal expertise in AI, data protection, and technology law. ISiCO describes this partnership as forming a 360° solution integrating consulting, technology, and legal expertise.
• GDD (Gesellschaft für Datenschutz und Datensicherheit e.V.)minorOthersGerman Association for Data Protection and Data Security. ISiCO is an active member, leveraging industry network and contributing to data protection community in Germany.
• Bitkom (Bundesverband Informationswirtschaft, Telekommunikation und neue Medien e.V.)minorOthersGerman Association for Information Technology, Telecommunications and New Media. ISiCO is an active member, leveraging industry network and contributing to IT policy discussions in Germany.
• COMPUTAS GmbHminorStrategic or Co-development PartnerCOMPUTAS is a partner in the DuD (Datenschutz und Datensicherheit) conference. ISiCO is the official organiser of the DuD conference, previously organised by COMPUTAS. ISiCO also organises the Datenschutztag and Cybersicherheitstag in Köln in partnership with COMPUTAS.

Scale indicators4 records

Recent moves9 records

Expansion highlights6 records

Broad incumbents

• PwC Germany: Big 4 consultancy offering cybersecurity, privacy, and AI governance services to DAX and mid-market clients in Germany, broadly overlapping ISiCO's service catalogue.
• TÜV Rheinland: Global testing, inspection, and certification group with IT security and data protection consulting; overlaps with ISiCO on ISO 27001, TISAX, and information security advisory.
• TÜV SÜD: A large German certification body and consultancy with substantial ISO 27001, TISAX, and information-security advisory practices; a broader incumbent in the same ISMS certification space.
• KPMG Germany: Big 4 firm with a large German cyber, risk, and regulatory practice; competes for enterprise NIS2, DORA, and ISO 27001 mandates that overlap with ISiCO's portfolio.

Emerging players

• Secfix: European GRC automation platform focused on ISO 27001 and GDPR compliance for SMEs; an emerging productised alternative that competes for ISiCO's mid-market compliance clients.
• Vanta: A fast-growing GRC automation SaaS platform that productises ISO 27001, SOC 2, and compliance workflows; an emerging productised competitor to parts of ISiCO's advisory plus caralegal offering.

Direct peers

• Datenschutz Nord: A German data-protection consultancy offering external DPO services and ISO/security consulting to SMEs and mid-market, directly comparable to ISiCO's core service lines.
• Schürmann Rosenthal Dreyer Rechtsanwälte: The technology and data law firm co-founded by ISiCO's founders; provides AI, data, and technology law advice that complements ISiCO's consulting offering as part of the same group.
• Datenschutzkanzlei: A well-known German law firm/consultancy focused exclusively on data protection and privacy, similar in customer base and regulatory specialism to ISiCO.
• msg group: A large German IT consultancy with a dedicated GRC, cybersecurity, and compliance practice serving regulated industries in DACH; overlaps with ISiCO's enterprise IT-security and ISMS work.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/isico_ds
• Facebookfacebook.com/isico.datenschutz

Revenue estimate

Valuation estimate

Number of profiles

Subsidiaries2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ISiCO Datenschutz