Career

• 2021 Managing Director and Founder of DPL Drewes Privacy Law Rechtsanwaltsgesellschaft mbH
• 2014 Managing Director and Founder of
  ADCERT Privacy Audit GmbH
  
• 2012 Specialist attorney for industrial property rights
• 2010 Managing Director and Founder of
  DPA Drewes Privacy Advice GmbH
  
• Since 2001 attorney in the field of data protection, most recently as partner of the law firm Pauly & Partner PartG mbB in Bonn as well as data protection officer for various companies
• 1999 Admitted to the bar, initially working for the Association of Private Broadcasting and Telecommunications (VPRT, now VAUNET – Verband Privater Medien e. V.)
• 2001 Doctorate at the University of Potsdam
• Legal clerkship at the Higher Regional Court of Düsseldorf
• Law studies at the Universities of Bonn, Geneva and Fribourg
• Since 2026, lecturer in data protection law at the University of Cologne

Main areas of activity

• Legal advice on data protection for large corporate groups and international corporations, including several DAX40 companies on all data protection issues.
• Focus on the area of (online) marketing and employee data protection
• Sparring partner for (corporate) data protection officers

Industries

• Mail order
• Company in the field of online marketing / dialogue marketing
• Real Estate
• Automotive industry
• Energy supplier
• NGOs
• State-licensed organizers of gambling
• Service company
• Trade fair organizer

Awards & Memberships

• For several years, the“Kanzleimonitor” study has ranked Dr. Drewes among the most highly recommended attorneys in the field of data protection.
• Dr. Stefan Drewes has been listed among the top 100 business lawyers in Germany by Kanzleimonitor for several years.
• Member of the Society for Data Protection and Data Security(GDD)
• Member of the International Association of Privacy Professionals (IAPP). He was also the founder and, for several years, co-chair of the IAPP KnowledgeNet Rhein-Ruhr.

Publications

Commentaries, manuals, monographs

• Commentary on Articles 37–39 of the GDPR in Simitis/Hornung/Spiecker: Data Protection Law (2nd ed., 2025)
• Data Protection in Clubs, by Reichert: Club and Association Law (15th ed., 2023)
• Compliance and Data Protection in Besgen: Legal Handbook for Senior Executives, Managing Directors, and Board Members (2nd ed., 2023)
• Commentary on Articles 37–39 of the GDPR in Spiecker et al. (ed.), Döhmann | Papakonstantinou | Hornung | Hert: General Data Protection Regulation (2021)
  (co-authored with Dr. Sebastian Bretthauer)
• Chapter on Data Protection in Heidel/Pauly’s Law Forms (10th ed., 2021)
  (co-authored with Attorney Sebastian Wilfling)
• Commentary on Art. 37-39 GDPR in Simitis/Hornung/Spiecker: Datenschutzrecht (2019).
• Compliance and Data Protection in Besgen: Handbook for Managers (2011)
• Dialogue marketing after the 2009 amendment to the BDSG
• Editing of various keywords in Bäumler / Breinlinger / Schrader: Datenschutz von A-Z (2003 supplement)
• New types of use in copyright law, dissertation 2001

Contributions to journals

• Direct Mail Advertising and Address Data Based on Legitimate Interests, ZD 2024, 68 ff.
• What of § 15 para. 3 TMG remains, CR 2020, 602 et seq.
• Critical view of the DSK guidance on direct advertising, ZD 2019, 296 et seq.
• Dialog marketing under the GDPR without the consent of the data subjects, CR 2016, 721 et seq.
• Borderless Commissioned Data Processing, PinG Privacy in Germany 2014, 134 et seq. (together with Manfred Monreal)
• Promotional Use of Data – The Implosion of the BDSG Amendment and Implications of ECJ Case Law, ZD 2012, 115 et seq.
• Address trading – everything only with consent? RDV 2011, 18 ff.
• Dialog Marketing after the New List Privilege, CR 2010, 759 et seq.
• The implied consent in telemarketing and the end of the dogma of the written form under data protection law, RDV 2006, 139 (together with Michael Siegert, attorney).
• The external data protection officer and the professional secrecy of pharmacists, RDV 2005, 14 ff.