isico datenschutz & informationssicherheit

What isico datenschutz & informationssicherheit does

ISiCO GmbH is a German management consultancy founded in 2009 (with company registration indicating 2010) and headquartered at Am Hamburger Bahnhof 4 in Berlin, with additional offices in Cologne and Munich. The firm specializes in four intertwined practice areas: data protection consulting (GDPR, DPIA, ROPA, external DPO services), information security (ISMS, ISO 27001, NIS2, DORA, TISAX, ransomware, IT forensics), AI compliance (ISO 42001 certification, external AI officer services), and data strategy (maturity assessments, governance, data products). The company serves a hybrid mix of SMEs and "hidden champions," DAX-listed corporates and groups, tech companies and digital platforms, and public sector / critical infrastructure organizations across the DACH region and internationally, with delivery handled in-person at client sites, at ISiCO offices, or remotely.

ISiCO's core technology stack consists of two proprietary or partnered software platforms bundled with consulting engagements: caralegal, a data responsibility/compliance management platform designed to consolidate GDPR and related obligations into a single interface, and lawpilots, an e-learning platform for compliance training that the company describes as engaging "as a Netflix series." The platform pair represents a "consulting + software" bundling strategy intended to create recurring engagement and reinforce customization, though neither is positioned as a stand-alone product in the market. Integration with a co-founded technology law boutique (Schürmann Rosenthal Dreyer Rechtsanwälte) provides legal interpretation depth that competing consultancies must subcontract.

The revenue model is primarily professional services (project-based consulting engagements plus training/workshops) with a smaller, recurring subscription component from caralegal and lawpilots. ISiCO explicitly avoids template-based or publicly disclosed pricing; each engagement is tailored to client size, sector and scope, with a free 15-minute initial consultation used as lead generation. Customer acquisition runs through direct enterprise field sales, content marketing via website and monthly newsletter, and the firm's own conference circuit (Datenschutztag, Cybersicherheitstag, DuD). Named customers include Zalando, Clark, Spie, Fressnapf, Vivantes, medios, Smyths and Biotest, spanning insurance, e-commerce, technical services, retail, healthcare and pharma.

Name

isico datenschutz & informationssicherheit

Legal name

ISiCO GmbH

Website

https://isico.de

Company type

Private

Founded year

2010

Operating status

Operating

Short description

ISiCO is a Berlin-based German management consultancy (founded 2009/2010) specializing in data protection, information security, AI compliance, and data strategy. It serves SMEs, DAX corporates, tech firms, and public sector organizations via offices in Berlin, Cologne, and Munich.

Ownership category

akta.pro rank

Product category

Data Protection & Information Security Consulting

NAICS

Management, Scientific, and Technical Consulting Services (5416), Management Consulting Services (54161), Custom Computer Programming Services (541511)

SIC

Services-Engineering, Accounting, Research, Management (8700), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

ITSM Governance, Compliance & Audit Readiness (BPAEAJAM)

Keywords

• Data protection consulting
• Information security consulting
• GDPR compliance advisory
• ISO 27001 certification
• External data protection officer

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Data Protection Consulting Services: Core consulting services providing data protection, GDPR compliance, external DPO services, and related advisory work to organizations of all sizes.
2. IT Security Consulting: Information security consulting including ISMS implementation, ISO 27001 certification support, NIS2 compliance, and security audits.
3. AI Consulting & Data Strategy: Specialized consulting for AI compliance, ISO 42001 certification, and data strategy development.
4. Software Platforms (caralegal & lawpilots): Proprietary software platforms offered as part of the solution ecosystem - caralegal for compliance management and lawpilots for compliance training.
5. Training & Workshops: Employee training services and professional workshops on data protection, information security, and compliance topics.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

ISiCO is a German management consultancy that advises enterprises on data protection, information security, AI compliance, and data strategy. Its core deliverables include external DPO services, GDPR compliance programs, ISMS implementation (ISO 27001, NIS2, DORA, TISAX), AI management (ISO 42001), and data strategy maturity assessments, delivered as bespoke consulting engagements complemented by the proprietary caralegal compliance platform and lawpilots e-learning solution.

Product overview

ISiCO is a management consultancy providing specialized consulting services in data protection, information security, AI, and data strategies. The firm operates primarily as a services-based consultancy rather than a software product company. Its portfolio includes data protection consulting (DPIA, threat modelling, data breaches, ROPA, employee data protection, DPMS, erasure and archiving policies), external DPO services, IT security services (ISO officer, ISMS, ISO 27001 certification, ransomware protection, risk management, IT compliance, NIS2, DORA, TISAX certification, IT forensics, Cyber Resilience Act), AI consulting (ISO 42001 certification, external AI officer), data strategy (maturity assessment, data governance, data products), and solutions (workshops, DPO coaching). Two complementary software products are offered through partnerships: caralegal (a data protection management software platform) and lawpilots (an e-learning platform for compliance training). The firm has offices in Berlin, Köln, and München.

Differentiator

Problem solved

Functional benefit

Brands

• caralegal: A data responsibility platform that simplifies the fulfilment of data protection requirements, bringing together all aspects of compliance in one comprehensive software.
• lawpilots

Products and services

• Data Protection Consulting Bespoke data protection consulting engagements covering Data Protection Impact Assessments (DPIA), threat modelling, data breach response, Records of Processing Activities (ROPA), employee data protection and HR 4.0, Data Protection Management Systems (DPMS), erasure and archiving policies, and communication with supervisory authorities. Targeted at organisations seeking GDPR compliance and ongoing data protection advisory.
• External Data Protection Officer (DPO) External DPO-as-a-service providing outsourced Data Protection Officer functions including 24/7 emergency contact, for organisations that need mandated or voluntary DPO coverage without an in-house appointment.
• Data Protection Audits Structured data protection audits that identify gaps and provide practical recommendations to improve an organisation's data protection posture.
• EU Representative Service Appointment as EU Representative under GDPR Article 27 for non-EU companies that process personal data of EU residents, fulfilling the statutory representation requirement.
• Whistleblower Protection Act Service Advisory and implementation support for compliance with the German Whistleblower Protection Act (Hinweisgeberschutzgesetz) for affected companies.
• IT Security Consulting Bespoke information security consulting covering external Information Security Officer (ISO), ISMS implementation, ISO 27001 certification support, ransomware protection, risk management, IT compliance, NIS2 advisory, DORA advisory, TISAX certification, IT forensics, and Cyber Resilience Act compliance. Targeted at organisations needing tailored IT security advisory.
• ISMS Service Packages (NIS2, ISO 27001, TISAX) Fixed-price ISMS implementation packages aligned to specific regulatory frameworks: NIS2-compliant ISMS, ISO 27001-compliant ISMS, and TISAX-compliant ISMS, providing scoped information security management system rollouts at predictable cost.
• ISO 27001 Certification Support Advisory and implementation support for organisations pursuing ISO 27001 certification, including gap assessment, ISMS build-out, and audit preparation.
• TISAX Certification Step-by-step advisory for TISAX (Trusted Information Security Assessment Exchange) certification, primarily used in the automotive industry.
• NIS2 Advisory Advisory on the EU NIS2 Directive obligations for affected organisations, including compliance scoping, control implementation, and regulator-readiness.
• DORA Advisory

Named customers6 records

Segments11 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature2 records

Partnerships

Four partnerships are on record, tiered core.

• caralegalcoreTechnology or Integrationcaralegal is a data responsibility platform that ISiCO developed and offers as part of their solution ecosystem. The platform simplifies fulfillment of data protection requirements and brings together all aspects of compliance in one integrated tool.
• lawpilotscoreTechnology or Integrationlawpilots is an e-learning platform that trains and inspires teams to embrace compliance, with content described as engaging as a Netflix series. ISiCO partnered with the market leader in regulatory training to offer this platform to their clients.
• Schürmann Rosenthal Dreyer RechtsanwältecoreStrategic or Co-development PartnerA technology, data and AI law firm that ISiCO partners with to provide a 360-degree solution integrating consulting, technology and training. The partnership creates synergy for managing data protection processes efficiently and sustainably. The law firm is also the co-founding entity behind ISiCO, with founders Kathrin Schürmann and Simone Rosenthal.
• ComputascoreStrategic or Co-development PartnerISiCO became official co-organizer of the Datenschutztag and Cybersicherheitstag conferences alongside Computas. They also co-organize the DuD (Datenschutz und Datensicherheit) conference.

Scale indicators2 records

Recent moves6 records

Expansion highlights6 records

Broad incumbents

• KPMG Germany: Big 4 firm with a sizable German Risk & Compliance practice covering data protection, cybersecurity (ISO 27001, NIS2), AI governance, and DORA. Represents the scale incumbent that increasingly competes with ISiCO for large enterprise compliance mandates.
• msg systems AG: Large German IT consultancy with substantial data protection, information security, and regulatory compliance practices serving DAX enterprises and the financial sector. Competes with ISiCO on enterprise NIS2, ISO 27001, and DORA engagements, but at much greater scale.
• Secunet Security Networks AG: Leading German IT security provider focused on critical infrastructure, public sector, and high-assurance cybersecurity. While more product-heavy, it competes with ISiCO for public-sector and critical infrastructure NIS2 and information security consulting work.
• TÜV Rheinland: Global testing, inspection and certification body operating a German cybersecurity and data protection advisory practice including ISO 27001 certification support and NIS2 readiness — overlapping significantly with ISiCO's IT security and certification services.

Emerging players

• Avanade: Joint venture between Accenture and Microsoft focused on Microsoft-platform security, data protection, and AI compliance deployments in Europe. Increasingly a competitor for enterprise Microsoft Purview / DPO-adjacent consulting work in the German market.
• Hornetsecurity: European (German-headquartered) cybersecurity SaaS provider offering compliance, backup, and security awareness services. Competes partially with ISiCO on information security compliance and training (adjacent to lawpilots).
• OneTrust: Global privacy, security and governance software platform that increasingly competes with ISiCO's caralegal offering by automating GDPR, AI governance, and ISO compliance workflows. Represents the SaaS-led threat that could commoditize parts of ISiCO's consulting work.

Direct peers

• Datatree AG (EQS Group): A German data protection consultancy that was acquired by EQS Group, providing GDPR consulting, DPO-as-a-service, and the Datatree compliance software platform. Closely mirrors ISiCO's combination of consulting plus a proprietary compliance technology.
• Datenschutz Nord GmbH: A Bremen-headquartered German consultancy specializing in external data protection officer services, GDPR consulting, and information security. One of the most directly comparable German boutique competitors to ISiCO in terms of service portfolio and target mid-market to enterprise customers.
• UIMC Dr. Victor GmbH: German data protection and information security consultancy offering external DPO services, ISO 27001 implementation, and compliance advisory. Operates with a similar boutique, multi-office German model and comparable enterprise focus.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/isico-datenschutz-informationssicherheit

Revenue estimate

Valuation estimate

Number of profiles

Profiles10 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about isico datenschutz & informationssicherheit