Legal Counsel
Generali Engagement Solutions GmbH · Munich · Generali Group
GDPR operations, IT/SaaS and data processing agreements, vendor risk.
Legal Counsel · Munich, Germany
Anatolii
Kostyrkin
Data protection, commercial contracts and compliance.
I turn regulation into contracts and processes people can follow.
Open to: Legal Counsel · Privacy Counsel · Compliance · AI Governance
Übersetzte Fassung · Arbeitssprache Englisch
20+ yearsLegal practice in Ukraine and Germany
CIPP/EEuropean data protection · IAPP
AIGPAI governance · IAPP
Three practice areas
Selected work
Three areas, the numbers behind them and one real process each, redrawn and anonymised.
01Data protection
GDPR work that runs every day
Access requests, staff guidance, retention and records of processing, handled in-house with the external DPO kept informed.
20 of 20access requests answered within the 30-day deadline
5business units following the GDPR guidance I wrote
~35non-legal staff trained on everyday data handling
Every access request answered on time
I built the intake and response process for platform users and employees, from the first email to the final answer and the note to the DPO.
- Intake and logRequest recorded, deadline set
- Verify identityProportionate checks
- Search systemsOwn systems and processors
- Review and redactThird-party data protected
- Respond and reportAnswer sent, DPO informed
My role. Designed and ran the process end to end, from intake and deadlines to searches across own systems and processors, redaction and the final answer, with DPO reporting built in. Updated the record of processing activities and adapted group policies to German law.
02Commercial contracts
Technology contracts, negotiated to close
IT, SaaS and data processing agreements, vendor due diligence with AI checks, and contract exits when a business winds down.
~20IT, SaaS and data processing agreements negotiated a year
100+agreements reviewed in a company wind-down
4health-data API RFPs reviewed before release to vendors
From vendor questionnaire to signed contract
A risk-based questionnaire decides how deep the checks go, and what it finds goes straight into the contract.
- QuestionnaireLegal entity, owners, sanctions and PEPs
- Risk profileAML and anti-bribery red flags, documented and escalated
- AI and data checksEU AI Act self-assessment, human oversight, transparency, data use
- Contract safeguardsDPA, security, audit, subcontractors, exit
- MonitoringRe-check on trigger events after onboarding
My role. Designed the due-diligence questionnaire, including the AI-governance block, and personally assessed about 20 vendors in a multi-lot technology tender. The findings went straight into contract terms.
03Compliance
Risk-based compliance, sized to the business
A compliance management cycle inside an international group: regulatory watch, risk assessment, an annual plan, controls and reporting, scaled to a small entity.
21Group policies and guidelines checked for local application
45%+market concentration in an antitrust review that ended in clearance
2026compliance plan drafted and adapted to the wind-down
From regulatory change to board report
Within the Group framework, I owned the local deliverables: the annual plan, the risk records and the input for management reporting.
- Regulatory watchLaws, case law and regulator guidance
- Risk assessmentExposure mapped against control strength
- Compliance planAnnual activities based on the risks found
- Day-to-dayGroup policies applied, advice, incidents
- ReportingTo management and Group Compliance
My role. Drafted the 2026 compliance plan and rescoped it for the wind-down: data protection, AML, whistleblowing and tax reporting. Maintained around 50 policy and risk records a year in Archer and prepared the input for management and Group Compliance.
Before Germany
Litigation, M&A and a legal team
Eleven years at one of Ukraine’s largest media groups, from legal counsel to Head of Legal.
19 of 20court cases resolved without an adverse ruling
20companies acquired in one transaction
25+ → 8legal entities after group restructuring
7people in the legal team I built and led
750+employees the team supported
Writing
Notes on AI governance
Short posts written while preparing for the AIGP: one real case, one legal point, one open question.
Consumer law · generative AI
Labelled as AI, still misleading
Just Eat’s AI food images were all labelled. Why a true label doesn’t fix a misleading picture, and why it was a deployment problem, not a model problem.
Read on LinkedIn ↗ EU AI Act · Article 4AI literacy for people who aren’t your staff
The duty reaches agency workers and contractors using your AI “on your behalf”. You can’t train them yourself, so the measures end up in the contract.
Read on LinkedIn ↗ AI harms · recruitingOne rejected candidate, or a group harm?
Amazon’s experimental hiring tool as a way to separate individual, group and societal harm, and what should move a review from one level to the next.
Read on LinkedIn ↗References
What my managers say
LinkedIn recommendations from direct managers. Reference letters available on request.
“Anatolii combines attention to detail with a practical mindset. He does not just identify issues – he proposes clear, workable solutions and takes ownership of their implementation.”
“He works independently, takes ownership of his responsibilities and can be trusted with matters where accuracy and risk awareness are critical.”
Experience
Twenty years,
two countries.
Based in Munich and authorised to work in Germany. Before moving here I spent 11 years in Ukrainian media, where I built and led a legal team of seven.
Ukrainian and Russian (native) · English C1 · German B1
Head of Legal Department
Ukrainian Publishing Media House · Kyiv
M&A, restructuring, commercial contracts, litigation and team leadership.
Senior Legal Advisor, part-time
Grape Digital · Kyiv
Advertising and marketing contracts, campaign compliance.
Legal Adviser
Donetskmiskvodokanal · Donetsk · public utility
Litigation, contracts and regulatory compliance.
Education
M.Sc. International Law and Business Administration · Ukrainian Free University, Munich · grade 1.6
Thesis on foreign investor protection in Ukraine and alignment with EU law in post-war reconstruction
Specialist in Law with honours · Donetsk University of Economics and Law
Credentials
CIPP/E · IAPP
AIGP · IAPP
Regulatory Compliance, University of Pennsylvania (2026)
Contact
Let’s talk.
Open to in-house legal, privacy and compliance roles. Happy to meet in Munich or online.
Available from 1 January 2027.
Anatolii KostyrkinLegal Counsel · Munich
Download CV (PDF)
Emailk@anatolyy.com
LinkedInProfile and posts on AI governance
Location and work modeMunich · on-site, hybrid or remote from Germany