Records · Art. 30
01 · Foundation
External Data Protection Officer
Appointed under Art. 37 GDPR and § 38 BDSG. Advice, monitoring, training, contact with the supervisory authority. Monthly, with fixed availability and documentation in one place.
Free first callAt a glance
- Legal basis
- Art. 37 GDPR in conjunction with § 38 BDSG
- Mandatory in Germany
- from at least 20 persons regularly and permanently engaged in automated processing (§ 38 (1) sentence 1 BDSG)
- Mandatory regardless of headcount
- for processing requiring a data protection impact assessment under Art. 35 GDPR, or commercial processing for the purpose of transfer (§ 38 (1) sentence 2 BDSG)
- Statutory tasks
- Art. 39 (1) GDPR, five tasks from advice to authority contact
- Target group
- companies up to 100 employees in the DACH region
- Response time
- reply to enquiries within two working days
- Languages
- German and English
- Billing
- fixed monthly fee instead of hourly billing
What the external data protection officer takes over
When a question comes up
New tool, new vendor, customer wants access? You ask instead of guessing. Reply within two working days.
When an employee makes the mistake
Trained, documented, repeated. The mistake stays an isolated case, not your liability.
The five tasks under Art. 39 GDPR
The list of duties is not in the contract, it is in the law. These five points are what a data protection officer owes, internal or external.
- a)Informing and advising the controller and its employees about their obligations under the GDPR and other data protection provisions.
- b)Monitoring compliance with the regulation, including staff training and audits.
- c)Advising on the data protection impact assessment and monitoring its performance.
- d)Cooperating with the competent supervisory authority.
- e)Acting as contact point for the supervisory authority on processing matters, including prior consultation.
Legal references checked on 7 September 2026 on dsgvo-gesetz.de. This is general information and does not replace individual legal advice.
Deadlines that count when it matters
Three numbers that decide whether an incident stays an incident or becomes a proceeding. We keep track so nobody has to do the maths under pressure.
72 hours
Notification of a personal data breach to the supervisory authority: without undue delay and, where feasible, within 72 hours of becoming aware of it. Later means: with reasons for the delay.
Art. 33 (1) GDPR
One month
Response to a data subject request, for example an access request. Extendable by two further months where the complexity or number of requests requires it, with notice inside the first month.
Art. 12 (3) GDPR
Up to EUR 20 million
Upper level of fines: up to EUR 20 000 000 or up to 4 per cent of total worldwide annual turnover, whichever is higher. The lower level is EUR 10 000 000 or 2 per cent (Art. 83 (4) GDPR).
Art. 83 (5) GDPR
Legal references checked on 7 September 2026 on dsgvo-gesetz.de. This is general information and does not replace individual legal advice.
Frequently asked questions about the DPO role
Advises management and staff, monitors compliance, assists with data protection impact assessments, is the point of contact for data subjects and cooperates with the supervisory authority (Art. 39 GDPR). In practice this includes maintaining the mandatory documents: records, vendor contracts, technical and organisational measures, deletion concept.
In Germany, as soon as at least 20 persons are regularly and permanently engaged in automated processing of personal data (§ 38 (1) sentence 1 BDSG). Regardless of headcount, the duty applies when processing requires a data protection impact assessment under Art. 35 GDPR or when data is processed commercially for the purpose of transfer (§ 38 (1) sentence 2 BDSG). Below the threshold all other GDPR duties still apply.
An internal DPO ties up working time, needs ongoing training and, if the appointment is mandatory, enjoys special dismissal protection (§ 6 (4) BDSG). An external DPO brings expertise and tools, costs a fixed monthly fee and can be ended with the contract. For companies up to 100 employees the external option is usually the more economical one.
We take them over. During the analysis we review existing records, contracts, policies and training records, check them for currency and transfer them into the system. Nothing is done twice.
We reply to enquiries within two working days. In the case of a personal data breach the statutory deadline applies: notification to the supervisory authority must be made without undue delay and where feasible within 72 hours of becoming aware of it (Art. 33 (1) GDPR).
What happens after the first call
01
First call
30 minutes, free and non-binding. You describe the situation, we ask the right questions.
02
Proposal
A fixed proposal within 48 hours, matched to the size and processes of your company.
03
Start
Once confirmed, the analysis begins. You know in advance what we need and how long it takes.
More services
Let us start with clarity.
Free first call, 30 minutes. You describe where you stand, we tell you what needs doing.
Request first call