Data Privacy

Definition: Data privacy is the protection of personal data against misuse. In the EU, the GDPR (General Data Protection Regulation, German: DSGVO) regulates this. Personal data is information that relates to an identified or identifiable natural person, e.g. names, email addresses, IP addresses and user behavior.

Data Privacy vs. Data Security in B2B Mechanical Engineering

Important distinction:

Data privacy (GDPR): Protection of personal data (names, emails, user accounts). Legal requirements: consent, right of access, obligation to delete.

Data security: Protection of all data against technical threats (hacking, theft, loss). Applies to: CAD designs, 3D models, intellectual property, trade secrets.

In B2B, data security requirements clearly dominate:

CAD data, design drawings and 3D models of machines contain no personal data. The design of a packaging machine does not fall under the GDPR. It contains technical geometries, material specifications and tolerances, but no names or emails.

The main challenge for machine builders is the protection of intellectual property (IP): confidential designs must not get into the wrong hands (competitors, unauthorized third parties). This requires encryption, access control and DRM. All of these are topics of data security, not of data privacy.

Data privacy is only relevant for: - User management on 3D platforms (names and emails of employees or customers) - Analytics (tracking of user behavior in web viewers) - CRM data (customer contacts)

Frequent Confusion of the Terms

Problem: Many vendors and consulting agencies confuse data privacy and data security, or use the terms as synonyms.

Typical miscommunication: - A vendor advertises "GDPR-compliant" (data privacy), but means "ISO 27001-certified" (data security) - An agency sells "data privacy consulting", but addresses encryption and backups (= data security) - A customer asks for "data privacy for CAD data", but means protection against IP theft (= data security)

Reality: In English-speaking countries, this confusion occurs less often, because the terms "data privacy" (German: Datenschutz) and "data security" (German: Datensicherheit) are clearly separate.

When Is Data Privacy Relevant in B2B?

1. User management: Cloud platforms for 3D visualization store user data (names, emails, login data) → GDPR obligations apply.

2. Analytics and tracking: Web viewers record user behavior (which machine the user viewed, for how long, which details the user zoomed in on) → consent required, cookie banner.

3. Customer data: CRM systems with customer contacts and contact persons → GDPR compliance (right of access, obligation to delete).

Data privacy requirements apply to these areas, but they are not the main risk in B2B mechanical engineering.

For CAD Data and 3D Models: See Data Security

Most of the security requirements in B2B mechanical engineering concern data security, not data privacy:

  • How do I protect confidential CAD designs against theft?
  • Which encryption do I need for 3D models in the cloud?
  • How do I prevent the download of 3D models from web viewers?
  • Which certifications (ISO 27001, SOC 2, TISAX) are necessary?
  • How do I protect CAD data during customer presentations?

→ The article Data Security answers all of these questions.

Data security: - Data security – Protection of CAD data and IP - Encryption – Encryption for 3D data - Access control – Control of user access - ISO 27001 – Information security - IP protection – Intellectual property protection

Compliance: - GDPR – EU General Data Protection Regulation - SOC 2 – Service Organization Control - TISAX – Automotive security - NDA – Non-disclosure agreement - Compliance management – Regulatory compliance