Data Protection Officers in Germany

When companies in Germany need data protection officers

Data protection officers (DPOs) are mandatory for many more companies in Germany than in most other EU Member States. The General Data Protection Regulation (GDPR) requires a DPO where the core activities of a controller or processor consist of large-scale regular and systematic monitoring of individuals, or large-scale processing of special categories of data or criminal offence data (Article 37(1) GDPR).

Germany has used the opening clause in Article 37(4) to add a national threshold: under § 38(1) of the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), controllers and processors must designate a DPO if they generally employ at least 20 persons who are constantly engaged in the automated processing of personal data. Regardless of headcount, a DPO is required if the company carries out processing subject to a data protection impact assessment under Article 35 GDPR, or processes personal data commercially for the purpose of transfer, anonymised transfer, or market or opinion research.

For a typical German company, the 20-person threshold is the decisive rule. Because almost every office employee who uses email, CRM or HR software processes personal data automatically, the threshold is reached quickly. Companies that fall below it may still need a DPO because they carry out high-risk processing that requires an impact assessment. And companies that are not obliged can appoint one voluntarily — with different consequences for dismissal protection.

Counting the 20 persons

The threshold refers to persons "constantly" engaged in automated processing of personal data, generally employed. Courts and authorities interpret this broadly: it includes employees, trainees, temps and freelancers who regularly work with personal data in IT systems, irrespective of whether they work full time. Persons who only occasionally process data, such as production staff who rarely use a computer, are not counted. The count is made per controller — each legal entity in a group is assessed separately — and should be reviewed when the company grows or digitalises processes.

Tasks and position of data protection officers

The DPO's tasks are set out in Article 39 of the GDPR: informing and advising the company and its employees about their obligations, monitoring compliance — including the assignment of responsibilities, awareness-raising, training and audits — advising on data protection impact assessments, cooperating with the supervisory authority and acting as its contact point. Data subjects may contact the DPO about any issue related to the processing of their data. The DPO is not personally responsible for compliance; responsibility remains with the controller.

The GDPR guarantees the DPO's independence (Article 38). The company must involve the DPO properly and in a timely manner in all data protection issues, provide the necessary resources and access, ensure that the DPO receives no instructions regarding the exercise of their tasks, and allow the DPO to report directly to the highest management level. The DPO must not be dismissed or penalised for performing their tasks. The DPO's contact details must be published and communicated to the supervisory authority (Article 37(7)).

Conflicts of interest

The X-FAB case concerned an employee who was chair of the works council and was also designated as DPO for the employer and its German group companies. The Court ruled in its judgment of 9 February 2023 that the second sentence of Article 38(3) GDPR does not preclude national legislation allowing dismissal of an internal DPO only for just cause, even where the dismissal is unrelated to the performance of the DPO's tasks, provided this does not undermine the GDPR's objectives.

A DPO may fulfil other tasks, but these must not result in a conflict of interest (Article 38(6)). The Court of Justice of the European Union clarified in X-FAB (C-453/21, 2023) that a conflict exists where the DPO is entrusted with tasks that would lead them to determine the purposes and means of processing personal data — something that must be assessed case by case. Heads of IT, HR, marketing or legal, and managing directors, are therefore generally unsuitable as DPOs. Combining the role of data protection officer with a works council chair is not automatically excluded, but it must be examined against the company's structure and policies.

Dismissal protection in Germany

Where designation of a DPO is mandatory, German law adds strong protection. Under § 38(2) in conjunction with § 6(4) BDSG, the designation of an internal DPO can be revoked only for good cause analogous to § 626 of the Civil Code, the DPO's employment can be terminated only for good cause without notice, and this protection continues for one year after the DPO's role ends. The protection does not apply where the company has designated a DPO voluntarily. In practice, this makes the appointment of an internal DPO a long-term personnel decision.

The Court of Justice has confirmed that this German approach is compatible with EU law. In Leistritz (CJEU, judgment of 22 June 2022, C-534/20), a company had dismissed its internal DPO, citing a restructuring that outsourced the role. The Court held that the GDPR does not preclude national rules allowing termination of a DPO's employment only for just cause, even where the termination has nothing to do with the performance of the DPO's tasks, as long as the GDPR's objectives are not undermined. A reorganisation decision to switch to an external DPO is therefore generally not, by itself, sufficient cause to dismiss a mandatory internal DPO.

Revocation versus termination

German law distinguishes between revoking the designation as DPO and terminating the underlying employment contract. Both require good cause where the designation is mandatory. If an internal DPO is removed from the role, the employment relationship generally continues, and the post-role protection runs for a further year. Employers who plan a change in the DPO model should therefore map the employment-law consequences before announcing it, and consider whether a negotiated solution is more practical than a contested dismissal.

Internal or external DPO

Companies can designate an employee or engage an external DPO under a service contract (Article 37(6) GDPR). Each option has advantages:

• Internal DPO: close knowledge of the business, availability, integration into processes; but special dismissal protection, training costs and potential conflicts with other roles.
• External DPO: specialist expertise, flexibility, no dismissal protection under § 6(4) BDSG (the service contract can be terminated in accordance with its terms, though not for performing the role), clear separation from operational functions; but less day-to-day presence and fees.

Many companies choose a hybrid model: an external DPO supported by an internal data protection coordinator who handles everyday matters. Groups may designate a single DPO for several entities if the DPO is easily accessible from each establishment (Article 37(2)).

Qualifications and resources

The DPO must be designated on the basis of professional qualities, in particular expert knowledge of data protection law and practices, and the ability to fulfil the tasks (Article 37(5)). Authorities expect knowledge of the GDPR and BDSG, the company's sector and IT. The company must provide time, budget, training and access to information; a DPO who has only a few hours a month for a large company is a compliance risk in itself.

Designating data protection officers in practice

The designation should be made in writing and should set out the DPO's tasks, reporting line to management, time budget, resources, and arrangements for deputies and confidentiality. Under § 38(2) with § 6(5) sentence 2 BDSG, the DPO is bound to secrecy about the identity of data subjects and about circumstances that would allow them to be identified, unless the data subject releases the DPO from this obligation. For external DPOs, the service contract should also deal with term, notice, liability, insurance and the handling of confidential information, and should not allow termination as a reaction to the DPO's advice.

Data protection officers need a clearly defined position within the compliance organisation. Good practice is a regular report to the management board, documented in minutes, an annual activity plan and a procedure under which other departments must involve the DPO before new processing begins. Where the DPO's advice is not followed, the decision and its reasons should be recorded by management, because the DPO's role is advisory and responsibility stays with the controller.

Typical errors seen in practice include designating a DPO without publishing contact details, assigning the role to a managing director or IT head, giving the DPO too little time, and failing to involve the DPO in incident response or new IT projects. Each of these weaknesses can become relevant in a supervisory investigation.

Sanctions and liability

Failing to designate a DPO where required, or failing to ensure the DPO's position and tasks, can be fined up to EUR 10 million or 2% of worldwide annual turnover (Article 83(4) GDPR). Authorities often discover missing DPOs in the course of complaints or breach investigations. Internally, DPOs can be liable to the company for negligent advice under their employment or service contract; external DPOs typically carry professional indemnity insurance. See our insight on GDPR fines in Germany.

Data protection officers and new digital laws

The role of data protection officers is expanding. They are typically consulted on AI deployments, because many AI uses involve personal data and may require impact assessments; on NIS2 security measures and incident reporting; and on Data Act data-sharing obligations where personal data are involved. While the AI Act does not require a separate AI officer, many companies assign AI governance tasks to a team that includes the DPO. Care is needed to avoid conflicts of interest where the DPO is given operational decision-making power. See our insight on AI literacy under Article 4 AI Act.

Checklist for companies

1. Count persons constantly engaged in automated processing per legal entity.
2. Check whether any processing requires a data protection impact assessment.
3. Decide on internal, external or hybrid DPO and check conflicts of interest.
4. Formalise the designation in writing and define resources and reporting lines.
5. Publish contact details and notify the supervisory authority.
6. Involve the DPO early in projects and document the DPO's advice.

How TRW & Co helps with data protection officers

We advise companies on whether they need data protection officers, on structuring internal, external and group DPO models, on conflicts of interest and on employment-law aspects, including dismissal protection and revocation. We support DPOs and management with legal opinions on complex questions, impact assessments and authority proceedings. See our page on GDPR and data protection or contact us.