Good to know.

Advises management and staff, monitors compliance, assists with data protection impact assessments, is the point of contact for data subjects and cooperates with the supervisory authority (Art. 39 GDPR). In practice this includes maintaining the mandatory documents: records, vendor contracts, technical and organisational measures, deletion concept.

In Germany, as soon as at least 20 persons are regularly and permanently engaged in automated processing of personal data (§ 38 (1) sentence 1 BDSG). Regardless of headcount, the duty applies when processing requires a data protection impact assessment under Art. 35 GDPR or when data is processed commercially for the purpose of transfer (§ 38 (1) sentence 2 BDSG). Below the threshold all other GDPR duties still apply.

An internal DPO ties up working time, needs ongoing training and, if the appointment is mandatory, enjoys special dismissal protection (§ 6 (4) BDSG). An external DPO brings expertise and tools, costs a fixed monthly fee and can be ended with the contract. For companies up to 100 employees the external option is usually the more economical one.

We take them over. During the analysis we review existing records, contracts, policies and training records, check them for currency and transfer them into the system. Nothing is done twice.

Maintenance of the records of processing activities and of data processing agreements, including reminders on expiry or change. Plus tracking of training and deletion deadlines. The evidence is created automatically.

We reply to enquiries within two working days. In the case of a personal data breach the statutory deadline applies: notification to the supervisory authority must be made without undue delay and where feasible within 72 hours of becoming aware of it (Art. 33 (1) GDPR).