Data protection officer: when is one mandatory?
In Germany your company needs a data protection officer if it constantly employs as a rule at least 20 persons dealing with the automated processing of personal data (§ 38(1) BDSG). Regardless of that number, the duty applies to processing that needs a DPIA and in the cases of Art. 37(1) GDPR. The officer may be external.
When is a data protection officer mandatory?
The GDPR requires a data protection officer in three cases (Art. 37(1)): for public authorities and bodies, where your core activities require regular and systematic monitoring of people on a large scale, and where they consist of large-scale processing of special categories of data or of data on criminal offences.
Member States may require further cases (Art. 37(4)). Germany does so in § 38(1) BDSG with two rules.
First, you designate a data protection officer if you constantly employ as a rule at least 20 persons dealing with the automated processing of personal data. Second, regardless of that number you need one if you carry out processing subject to a data protection impact assessment, or process data commercially for transfer, including anonymised transfer, or for market or opinion research.
Art. 37(1) and (4) GDPR · § 38(1) BDSG
How do you count the 20 people?
The wording counts people, not full-time posts, and only those constantly involved in the automated processing of personal data. The whole workforce does not count automatically.
In our reading, anyone who regularly works with such data on a computer counts, for example with customer data in the ERP system, with payroll data or with customer emails. Someone who opens such a list only occasionally is not constantly involved.
An example: Hofmann Elektrotechnik GmbH (made up) has 85 staff, 60 of them electricians on site and 25 in the office. The 25 work every day with quotes, invoices, payroll data and customer emails. That makes at least 20, so Hofmann has to designate a data protection officer.
Whether the electricians who write job reports with customer names on a tablet also count, Hofmann no longer needs to settle. With 15 people in the office it would turn on exactly that; then it is worth asking the data protection authority of its federal state.
§ 38(1), first sentence, BDSG
Own employee or external service provider?
Both are allowed: the data protection officer may be a staff member or fulfil the tasks on the basis of a service contract (Art. 37(6)). A group of undertakings may appoint a single one, provided they are easily accessible from each establishment (paragraph 2).
The officer is designated on the basis of expert knowledge of data protection law and practice and the ability to fulfil the tasks in Art. 39 (paragraph 5). They receive no instructions on those tasks, may not be dismissed or penalised for performing them, and report directly to the highest management level, which in a GmbH means the managing directors (Art. 38(3)).
In Germany an internal data protection officer whom you are required to designate has special protection (§ 38(2) with § 6(4) BDSG). They can be removed only by analogy with § 626 BGB and dismissed only for good cause, which still holds for one year after the role ends. With an external officer you settle term and termination in the service contract.
Art. 37(2), (5) and (6) · Art. 38(3) GDPR · § 38(2) and § 6(4) BDSG
What the data protection officer does, and what stays with the company
The tasks are set out in Art. 39(1). The officer informs and advises management and staff, monitors compliance with the GDPR and with your own data protection policies including training, advises on the DPIA where requested, and is the contact point for the supervisory authority.
Your company involves them early in all issues relating to the protection of personal data and gives them the resources and access to data they need (Art. 38(1) and (2)). Data subjects can contact them directly (paragraph 4).
Your company remains responsible: it has to comply with the GDPR's principles and be able to demonstrate it (Art. 5(2), Art. 24(1)). The data protection officer advises and monitors; management has to decide.
Art. 38 and 39 GDPR
Common mistakes
Designating the head of IT or of HR. Other tasks are allowed as long as they do not lead to a conflict of interests (Art. 38(6)). The European guidelines WP 243 list such senior positions as a rule of thumb among the conflicting ones, because they determine the purposes and means of processing.
Overlooking the second rule. A processing that requires a DPIA, such as locating field staff, makes a data protection officer necessary even below 20 people (§ 38(1), second sentence, BDSG).
Designating and forgetting. Your company publishes the officer's contact details and communicates them to the supervisory authority (Art. 37(7)); in Germany, for companies, that is the authority of their federal state (§ 40 BDSG).
Art. 37(7) · Art. 38(6) GDPR · § 38(1) and § 40 BDSG
With an AI assistant
An AI assistant such as Claude, ChatGPT or Copilot can count from your organisation chart who may fall within the 20 people and list the borderline cases. It can draft the designation, a description of the tasks under Art. 39 and the paragraph for your privacy notice.
Whether you designate and whom is your company's decision, and the GDPR assigns the tasks themselves to the data protection officer. For counting, the assistant needs roles, not names; whatever you show it, its vendor processes too.
A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.
Common questions
Can the managing director be the data protection officer?
Under the guidelines WP 243, heading the company is, as a rule of thumb, one of the positions with a conflict of interests. The data protection officer may not hold a position in which they determine the purposes and means of processing, and that is exactly what management does. The officer is meant to report to it and advise it (Art. 38(3), Art. 39(1)).
Do part-time staff and apprentices count?
§ 38 BDSG counts people, not posts, and does not ask about the type of contract. In our reading, part-time staff, apprentices and agency workers therefore count too if they are constantly involved in the automated processing of personal data.
Does a data protection officer need a certificate?
The GDPR names no particular certificate. It requires professional qualities, expert knowledge of data protection law and practice, and the ability to fulfil the tasks in Art. 39 (Art. 37(5)). Your company provides the resources to maintain that knowledge (Art. 38(2)).
Can an AI be the data protection officer?
In our reading, no. The GDPR requires professional qualities (Art. 37(5)), protects the data protection officer against dismissal and penalties, and binds them to secrecy (Art. 38(3) and (5)). That describes a person, or a service provider acting through people. An assistant can support them.
Does data protection apply at all below 20 people?
Yes. The threshold in § 38 BDSG concerns only the designation of a data protection officer. The GDPR's obligations still apply, and your company has to be able to demonstrate compliance (Art. 5(2)). Some obligations have their own thresholds, such as the record of processing activities (Art. 30(5)).
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 5(2), Art. 24(1), Art. 30(5), Art. 37, 38 and 39, with the corrigendum to Art. 37(1)(c) in OJ L 127 of 23.5.2018, CELEX 32016R0679, publications.europa.eu
- German Federal Data Protection Act (BDSG), § 6(4), § 38 and § 40, with the official English translation, gesetze-im-internet.de
- Article 29 Working Party, WP 243 rev.01, Guidelines on Data Protection Officers, section 3.5 on conflict of interests, endorsed by the European Data Protection Board, edpb.europa.eu
In the works
The GDPR walkthrough
After the NIS 2 walkthrough, nisd2.eu is building a GDPR walkthrough. It will work with the same MCP server, so your own AI assistant can fill it in too. We are not naming a date yet. Join the waitlist and we will write to you once it is ready.
With a free account on nisd2.eu. You can leave the waitlist at any time on the same page.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
