Data protection officer (DPO)

A Data Protection Officer (DPO) is a qualified individual who advises companies and public authorities on compliance with data protection laws and monitors their implementation. Under certain circumstances, appointing a DPO is mandatory pursuant to Article 37 of the General Data Protection Regulation (GDPR) and Section 38 of the German Federal Data Protection Act (BDSG). The DPO’s responsibilities and independent position are governed in particular by Articles 38 and 39 GDPR.

When is the appointment of a Data Protection Officer mandatory?

Whether a company is required to appoint a Data Protection Officer depends in particular on Article 37 GDPR and Section 38 BDSG. Relevant factors include both the number of individuals involved in data processing and the nature and scope of the processing of personal data.

Under Section 38(1) BDSG, non-public bodies in Germany are generally required to appoint a DPO if they normally employ at least 20 individuals on a permanent basis who are constantly engaged in the automated processing of personal data. These may include, for example, employees who regularly process customer data, employee information or other personal data using IT systems.

Regardless of this employee threshold, an appointment may also be mandatory in particular in the following cases:

• Public authorities: Under Article 37(1)(a) GDPR, public authorities and public bodies are generally required to appoint a DPO. An exception applies to courts acting in their judicial capacity.
• Large-scale monitoring: The core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale.
• Special categories of personal data: The core activities consist of processing special categories of personal data on a large scale under Article 9 GDPR, or personal data relating to criminal convictions and offences under Article 10 GDPR.
• Data protection impact assessments: Processing operations are carried out for which a data protection impact assessment is required under Article 35 GDPR.
• Certain data processing activities carried out as a business: Personal data are processed as part of a business activity for the purpose of transmission, anonymised transmission or market or opinion research.

Companies with fewer than 20 individuals regularly involved in automated data processing may therefore also be required to appoint a DPO.

What are the responsibilities of a Data Protection Officer?

The main responsibilities of a DPO are set out in Article 39 GDPR. The DPO supports companies and public authorities in understanding and implementing data protection requirements and monitoring compliance with them.

The key responsibilities include:

• Advisory role: Informing and advising company management and employees about their obligations under data protection law.
• Monitoring compliance: Monitoring compliance with the GDPR, other data protection provisions and internal data protection policies.
• Awareness-raising and training: Contributing to raising awareness among employees and providing training on the handling of personal data.
• Data protection impact assessments: Advising on the performance of data protection impact assessments and monitoring their implementation.
• Cooperation with supervisory authorities: Acting as the contact point for the competent data protection supervisory authority.
• Contact point for data subjects: Receiving questions from data subjects about the processing of their personal data and the exercise of their data protection rights.

The DPO should be involved at an early stage in projects relevant to data protection. This includes, for example, the introduction of new IT systems, the use of external service providers or the processing of particularly sensitive personal data.

It is important to distinguish between the respective responsibilities: the DPO advises and monitors compliance but is not solely responsible for ensuring compliance with data protection law. That responsibility remains with the relevant controller or processor.

Who can become a Data Protection Officer, and what requirements apply?

Under Article 37(5) GDPR, a DPO must be appointed on the basis of their professional qualities and, in particular, their expert knowledge of data protection law and practices, as well as their ability to fulfil the statutory responsibilities.

A DPO may be appointed internally from within the company or engaged externally under a service agreement. No specific vocational qualification or legally prescribed academic degree is required. What matters is the actual level of expertise and the individual's ability to perform the role.

The following requirements are particularly important when selecting and appointing a DPO:

• Expertise in data protection law: Knowledge of the GDPR, the BDSG and other relevant data protection provisions.
• Practical knowledge: Understanding of business data processing operations and the associated organisational and technical requirements.
• Ability to perform the role: The DPO must be capable of properly carrying out the statutory advisory and monitoring responsibilities.
• Internal or external appointment: The role may be performed by an employee of the company or an external service provider.
• Organisational integration: The appointment and responsibilities should be documented clearly. The DPO’s contact details must be published and communicated to the competent supervisory authority.

What is the position of the Data Protection Officer within a company?

The special position of the DPO is governed by Article 38 GDPR. The DPO must be properly and promptly involved in all matters relating to the protection of personal data and must be able to report directly to the highest level of management.

When performing their statutory responsibilities, the DPO must act independently and must not receive instructions. The company must support the DPO by providing sufficient resources, access to personal data and processing operations, and opportunities to maintain their professional knowledge.

Furthermore, the DPO must not be dismissed or penalised for performing their duties. For DPOs appointed on a mandatory basis by non-public bodies, the special rules on protection against dismissal and removal under Section 38(2) in conjunction with Section 6(4) BDSG apply.

Avoiding conflicts of interest is particularly important. A DPO must not simultaneously perform duties in which they themselves determine the purposes and means of processing personal data to a significant extent and would subsequently have to monitor the lawfulness of those decisions.

For this reason, holding the position of managing director, head of human resources or head of IT at the same time may be problematic. Whether an actual conflict of interest exists must be assessed in light of the specific responsibilities and decision-making powers involved.

Practical example: Appointing a Data Protection Officer in a company

A medium-sized company employs 35 people. Of these, 24 regularly process personal data using IT systems, for example in human resources, customer service and accounting.

Since the company normally employs at least 20 individuals who are constantly engaged in the automated processing of personal data, it is required to appoint a DPO under Section 38(1) BDSG.

Initially, management wants to assign this responsibility to the head of IT. However, the head of IT independently makes decisions about key IT systems and their use in processing personal data. This could give rise to a conflict of interest because, as DPO, they would also have to review decisions they had made themselves.

The company therefore decides to appoint an external DPO. The DPO is involved at an early stage in projects relevant to data protection, advises employees and monitors compliance with data protection requirements. Their contact details are published and communicated to the competent supervisory authority.

legal data assessment: Companies should not only determine whether they are legally required to appoint a DPO, but also whether the proposed individual has the necessary expertise and can perform their responsibilities independently. Potential conflicts of interest must be carefully considered, particularly where an internal DPO is appointed. A clear allocation of responsibilities, sufficient resources and early involvement in decisions relevant to data protection are essential prerequisites for an effective data protection organisation.

Legal bases

In particular, Articles 37, 38 and 39 GDPR and Section 38 BDSG. In addition, Article 35 GDPR on data protection impact assessments and the relevant statutory provisions applicable to public authorities must be taken into account.