Website for IT and data protection law firms: your site is your proof of competence

Why your website is your proof of competence

With a family law firm, visitors judge tone, photos and availability. With an IT and data protection law firm, a second test comes on top: your audience understands technology. The data protection coordinator of a mid-sized company opens the browser's developer tools before filling in your form. The CTO of a start-up sees in the network tab whether your site loads Google Analytics before he has agreed. And anyone who wants to appoint you as external data protection officer reads your privacy policy more closely than any other.

That is a risk and an opportunity at the same time. A pre-ticked cookie banner on the website of a data protection firm quickly gets talked about in professional circles. Conversely, a website without a banner, without data leaking out and with clean security settings is a reference you do not have to explain. You compete with data protection consultancies, certification bodies and IT service providers, which often have professional marketing departments. Your advantage is the quality of legal advice, and the website has to make that visible at first glance.

Your own website as a reference: technically flawless

The requirements are the same ones you recommend to your clients. The difference: with you, every deviation is noticed. The following overview shows what visitors check and what it should look like.

How to do without a banner and what belongs in the privacy policy is explained in detail in the guide cookie banners and data protection on a law firm website. For speed, see the article on the load time of a law firm website; for contrast, keyboard and forms, the guide on accessibility of law firm websites.

Services by regulation: GDPR, AI Act, NIS2, Data Act

Companies do not search for “IT law”, they search for their problem: “AI Act obligations for companies”, “check whether NIS2 applies”, “external data protection officer cost”. So create a separate service page for each regulation you actually advise on. Each page answers three questions: Who is affected? What has to be done by when? What do you take on, and how does the collaboration work?

State the status honestly. In Austria, the first implementing act, the NISG 2024, failed in the Nationalrat in July 2024 for lack of the required two-thirds majority. Only the NISG 2026 was passed in December 2025, promulgated on 23 December 2025 (BGBl. I Nr. 94/2025), and has applied since 1 October 2026. In Germany, the NIS2UmsuCG was promulgated on 5 December 2025 and entered into force the following day. A website that still says “NIS2 is coming in October 2024” mainly shows that nobody maintains the page.

Important for the presentation: many companies are not directly subject to NIS2, but are affected through the supply chain. Their customers demand evidence of information security, and contracts are being adjusted. A service page that says so openly (“You are not subject to NIS2 yourself, but your client is”) speaks to a much larger audience than a page that only lists thresholds.

External data protection officers: show packages and costs

The search “external data protection officer cost” shows what companies care about: they want to know what to expect before they call. Data protection consultancies often publish their prices. If your website only says “price on request”, the enquiries end up there. Art. 37(6) GDPR expressly allows the tasks to be fulfilled on the basis of a service contract, and that is exactly the offer you should make tangible.

For each package, state the basis of calculation (for example a monthly fee by number of employees), what the quota includes, how extra work is billed and that prices are net plus VAT. A price range “from … per month for companies with up to 50 employees” is enough. Point out two things companies often overlook:

• When there is a duty: Art. 37 GDPR requires a data protection officer for public bodies and for businesses whose core activities consist of large-scale monitoring or large-scale processing of special categories of data. Austria has no further threshold. In Germany, § 38 BDSG also applies: as a rule, a duty from 20 persons constantly engaged in automated processing, and regardless of headcount, for example, where processing requires a data protection impact assessment. The federal government has announced that it will repeal § 38(1) BDSG. Check the current status before publishing and state that the GDPR duties remain regardless.
• Conflicts of interest: under Art. 38(6) GDPR, the DPO role must not conflict with other tasks. Explain how you keep things separate if you also represent the same company in proceedings or advise it in a contract dispute.

How to present the costs of services clearly in general, and what the website itself costs, is shown in the guide on website costs for law firms.

B2B audiences and English pages

Your clients are almost always companies, and several people read along there: management, who decide on budget and liability; IT, who check feasibility; and sometimes purchasing, who compare offers. A good website gives each of these roles a way in. On the home page, entry points by occasion help (“We use AI”, “NIS2 applies to us”, “We need a data protection officer”, “We had a data breach”) rather than by section numbers.

• Industry pages: SaaS and software, health and medical technology, retail and e-commerce, manufacturing. Each with the regulations that matter there.
• Data breach as an emergency page: 72-hour reporting deadline under Art. 33 GDPR, for NIS2 an early warning within 24 hours. A dedicated page with a phone number and clear first steps gets found in that moment.
• English pages: start-ups, international teams and group subsidiaries often work in English. At least the home page, service pages, team and contact should be available in English, properly translated and with their own URL. How that works technically is described in the article on the multilingual law firm website.
• Visible contacts: companies want to know who does the work. Profiles with focus areas, languages, publications and talks are more convincing than a firm name alone.

And the question “LinkedIn or the website?” is the wrong one. On LinkedIn you reach decision-makers with short assessments; the website is where they then check whether you can take on the mandate. How the two work together is shown in the article on LinkedIn for law firms.

Titles, certificates and advertising: what the professional rules allow

IT and data protection law has many titles and seals, but lawyers may not use all of them the way consultancies do. In both countries the principle is the same: factual information about professional activity is allowed, misleading or sensationalist advertising is not (in Austria §§ 47 to 49 RL-BA 2015, in Germany § 43b BRAO and §§ 6 and 7 BORA).

You may state fine ranges factually if they are correct and put into context. The difference between information and scaremongering usually lies in the tone: “The GDPR provides for fines of up to EUR 20 million or 4 % of worldwide annual turnover; in practice, authorities set them case by case” informs. Capital letters, countdowns and exclamation marks do not.

Dated articles: staying current when laws change

Hardly any area of law changes as fast. Between 2024 and 2026 came the AI Act, the Data Act, two NIS2 implementing acts and the AI Omnibus. For your website, that is an advantage: every change is an occasion for a short, precise article that companies are searching for right then. How to find topics and structure articles is described in the guide expert articles for law firms.

Good, dated articles are also picked up by AI assistants, which companies now use for initial research. Whether ChatGPT, Gemini or Perplexity would name your firm for a question like “AI Act lawyer in Vienna” can be tested with the AI preview.

Common mistakes on the websites of IT and data protection law firms

• Lopsided cookie banner: “Accept all” large and coloured, “Reject” hidden. Exactly what you advise clients against.
• Google Fonts from Google's servers: a well-known cease-and-desist topic since the 2022 ruling of the Munich Regional Court I, and particularly embarrassing on a data protection website.
• Template privacy policy: sections on services that are not running, and missing sections on those that are.
• Outdated deadlines: “NIS2 from October 2024”, “high-risk AI from August 2026”.
• Only sections, no occasions: service pages that retell laws instead of saying what a company has to do and what you take on.
• No prices for standard services: companies compare external DPO offers, and without a price range you are out.
• German only: international companies and start-ups drop off.
• No emergency page for data breaches: when the 72 hours are running, nobody looks under “Services” in the menu.

The simplest test: check your own website with the same checklist you use for clients. Whatever you would object to there, your audience sees too.