Compliance Officer: Role, Responsibilities, Profile 2026

Main article: SME Compliance Liability of the Managing Director 2026: 6 Risks — the full article on the topic.

Mandatory function or practice recommendation? The legal framework

The provisions cited in this article address the company, the employer or the management — they do not prescribe a job title 'compliance officer'. Under the provisions cited here, the data protection officer and the internal reporting channel must expressly be designated or set up; in Germany there is the additional requirement that complaints under § 13(1) AGG must be examined and that the body responsible for complaints must be made known within the establishment (§ 12(5) AGG).

Data protection officer: Under Art. 37(1) GDPR, a DPO must be designated in any event where the processing is carried out by a public authority or body, where the core activity consists of regular and systematic monitoring of data subjects on a large scale, or where the core activity is the large-scale processing of special categories of data (Art. 9) or of data relating to criminal convictions (Art. 10). In Germany, § 38(1) BDSG applies in addition: a designation obligation where, as a rule, at least 20 persons are constantly engaged in automated processing — and irrespective of the number of persons where processing operations are subject to a data protection impact assessment under Art. 35 GDPR or where data are processed commercially for the purpose of transfer or for market and opinion research. Austria provides for no numerical threshold going beyond Art. 37 GDPR; § 5 DSG additionally governs the duty of confidentiality.

Internal reporting channel: Employers with, as a rule, at least 50 employees must set up and operate at least one internal reporting channel (§ 12(1) sentence 1 and (2) HinSchG). In Austria the obligation applies to undertakings with 50 or more employees (§ 3(1), § 11(1) HSchG).

Complaints body under the AGG: In Germany, employees have the right to complain to the competent bodies of the establishment, the undertaking or the agency if they feel disadvantaged on one of the grounds named in § 1 AGG; the complaint must be examined and the outcome communicated (§ 13(1) AGG). The body responsible for complaints must be made known within the establishment (§ 12(5) AGG). In Austria, the Ombud for Equal Treatment is responsible for advising and supporting persons who feel discriminated against within the meaning of the GlBG (§ 3 GBK/GAW Act).

Management instead of a role: In Germany, the NIS2 obligations apply directly to the managements of particularly important entities and important entities (§ 38(1) BSIG), and in Austria to the management bodies (§ 31(1) NISG 2026). How a company bundles the resulting work internally — in one role, in several, internally or externally — is an organisational decision. The role profile in this article is therefore to be read throughout as a practice recommendation, not as a statutory catalogue of duties.

1. Range of responsibilities

Maintaining the record of processing activities, auditing processor agreements, training, incident management, authority communication, management reporting — six blocks, each of which can be traced back to a specific provision.

Maintaining the record of processing activities. The record of processing activities (Art. 30 GDPR) is the working basis for almost everything else: without an up-to-date overview of the processing operations, neither can data subject requests be answered within the one-month period of Art. 12(3) GDPR, nor can the need for a data protection impact assessment under Art. 35(1) and (3) GDPR be assessed.

Processor agreement audits. Art. 28(1) GDPR permits cooperation only with processors providing sufficient guarantees of appropriate technical and organisational measures; paragraph (3) sets out the minimum content of the contract (subject matter, duration, nature and purpose, types of data, categories of data subjects, rights and obligations). For entities subject to NIS2, supply chain security is additionally part of the statutory minimum catalogue (§ 30(2) BSIG, AT: § 32(4) NISG 2026).

Training. Two groups of addressees with different bases: employees — in Germany under § 12(2) AGG, where suitable training counts as fulfilment of the employer's duty of protection; and the management under § 38(3) BSIG or § 31(2) NISG 2026 (which additionally requires that training be offered to staff on a regular basis). On top of this comes the AI literacy obligation of Art. 4 AI Act, which already had to be met by 2 February 2025.

Incident management. Two reporting lines run in parallel and on separate legal bases: the 72-hour notification to the data protection supervisory authority (Art. 33(1) GDPR) and the three-stage NIS2 scheme (DE: early initial report, report with initial assessment, final report — § 32(1) BSIG; AT: early warning, report with initial assessment, final report — § 34(2) NISG 2026). The initial reporting obligations of both lines run from awareness; the third NIS2 stage, by contrast, runs from the 72-hour report — which is why assigning an incident to one or to both lines belongs in the emergency plan and not in the incident situation itself.

Authority communication. Responsible in Germany are the supervisory authorities for non-public bodies determined under Land law (§ 40(1) BDSG) and the Federal Office for Information Security (BSI) as the central body for information security (§ 1 BSIG); in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG) and the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (§ 3a NISG 2026).

Management reporting. The obligation to monitor the implementation of the risk management measures lies with the management itself (§ 38(1) BSIG; in Austria the management bodies must ensure and supervise compliance, § 31(1) NISG 2026) — in practice this only works on the basis of a documented template (practice recommendation). The template should contain at least: open findings from the last internal audit with their severity, compliance with the time-bound cases of the reporting period (Art. 12(3) and Art. 33 GDPR, § 32 BSIG or § 34 NISG 2026, § 17 HinSchG or §§ 9 and 13 HSchG), the status of the NIS2 registration including notifications of changes (§ 33(1) and (5) BSIG, AT: § 29 NISG 2026), the training status of the management level (§ 38(3) BSIG, AT: § 31(2) NISG 2026) and of the employees (in Germany § 12(2) AGG). The design of this template is a practice recommendation; on the liability consequences see section 4, and the associated practice rhythms appear below the deadline table.

2. Profile requirements

Basic legal training (ideally business law), 3-5 years of compliance experience, CISA/CISSP nice-to-have, German and English language skills — that is the core profile of the first version. In professional terms, the role has to serve five frameworks simultaneously in 2026 — the GDPR (supplemented in Germany by § 25 TDDDG), NIS2 (BSIG or NISG 2026), the AI Act, the HinSchG or HSchG and the AGG or GlBG — plus pay transparency law; the dates of application and the detailed scope are set out in the FAQ 'Which areas of law does the role have to cover in 2026?'.

Two requirements come from the law and not from the job market. First, the confidentiality of the reporting channel: the identity of reporting persons and of persons concerned may be disclosed exclusively to the persons responsible for receiving reports and taking follow-up measures and to the persons supporting them (§ 8(1) HinSchG; in Austria protection of identity and a prohibition on disclosure to persons not responsible, § 7(1) and (2) HSchG). Anyone looking after the reporting channel must therefore actively keep information away from other roles — including their own. Second, the burden of proof rule of § 22 AGG: if, in a dispute, one party proves indications suggesting a disadvantage on one of the grounds named in § 1 AGG, the other party — in the employment relationship, as a rule the employer — bears the burden of proving that there was no infringement (AT: prima facie evidence under § 12(12) or § 26(12) GlBG). That makes clean documentation of selection and promotion decisions a core competence, not an optional extra.

3. Compensation 2026

This article does not give specific compensation bands: the figures of the first version (as at 2 May 2026) were not assigned to any named market survey and are not updated without our own survey. What drives the grading is the scope of responsibility — and that can be read off the obligations: whoever merely assists maintains the record of processing activities and the processor agreement register; whoever carries the role in full is responsible for the reporting routes in an incident (Art. 33 GDPR, § 32 BSIG or § 34 NISG 2026) and for the template for the management's monitoring duty (see section 4) — which career level takes on which duties is set out in section 6. For your own classification, use current comparative data that disclose their source and survey method.

Three drivers determine the scope of the role and thus its grading — as a suggested basis, not as a market standard. First, whether the entity falls within the scope of NIS2 at all (§ 28 BSIG, AT: §§ 24 and 25 NISG 2026): registration (§ 33 BSIG, AT: § 29 NISG 2026), the reporting deadlines in an incident and the evidence obligations then come on top, and they apply differently in each jurisdiction (see the section 'Austria'). Second, whether the role also looks after the internal reporting channel and is therefore bound by the confidentiality requirement of § 8(1) HinSchG (AT: § 7(1) and (2) HSchG), which forces a separation from other roles. Third, whether both jurisdictions have to be covered, that is, whether German and Austrian references have to be maintained in parallel.

4. Externalisation options

Three models are available: an external compliance officer, compliance as a service or a combination of internal and external. In SMEs the combination is common in practice (practice assessment) — the typical arrangement: an internal person in charge with 0.3-0.5 FTE plus an external specialist for 2-4 hours per month for strategy and audit preparation (empirical value, not a statutory requirement). The choice between internal, external and hybrid is decided by four criteria — workload, candidate availability in the DACH market, peak loads and specialist topics; these are set out in full, together with the disadvantages of the external solution, in the frequently asked questions. On sizing: for SMEs with 50-150 employees, an effort of 5-10 person-days per quarter for the compliance role plus around one person-day of management time has become established — an empirical value, not a statutory requirement.

This article does not give price figures for external solutions: the offers are not standardised to a uniform scope of services, so no direct price comparison can be derived from them. The price is driven above all by the agreed scope of services — in particular the monthly availability, which is limited for external solutions (typically 8-16 hours per month, empirical value from the first version) —, by the number of frameworks and jurisdictions to be covered and by whether looking after the internal reporting channel is included (section 3). Compare offers by the scope of services described, not by the monthly or annual amount.

What outsourcing does not shift is the addressee of the obligations. The management of particularly important entities and important entities must implement the risk management measures under Section 30 BSIG and monitor their implementation; if it breaches this duty, it is liable to its entity for culpably caused damage under the rules of the company law applicable to the legal form (§ 38(1) and (2) BSIG). Participation in training is likewise owed personally (§ 38(3) BSIG; AT: § 31(2) NISG 2026). An external service provider can prepare and document this work — the responsibility that the law assigns to the management level does not travel with it.

5. Division of responsibilities with the DPO

The DPO covers the GDPR only. The compliance officer covers all areas. Combining both in one person is possible, but a lot — three points decide whether it works in the specific case.

Scope. The DPO's statutory point of reference is the designation obligation under Art. 37(1) GDPR described above. Everything alongside it — NIS2 risk management (Section 30 BSIG, AT: § 32 NISG 2026), the AI Act, the reporting channel under the HinSchG or HSchG, equal treatment law under the AGG or GlBG — falls outside that scope.

Points of contact. One and the same incident can concern both roles: the notification of a personal data breach under Art. 33(1) GDPR and the NIS2 report under § 32(1) BSIG (AT: § 34(2) NISG 2026) rest on separate legal bases with their own deadlines and their own recipients. And in Germany the data protection impact assessment (Art. 35 GDPR) is at the same time a trigger of the DPO designation obligation irrespective of the 20-person threshold (§ 38(1) BDSG).

Limits of combining the roles. Practice recommendation: before any bundling, check the confidentiality boundary of the reporting channel (§ 8(1) HinSchG; AT: § 7 HSchG, see section 2). A role that simultaneously bundles HR matters, the reporting channel and, in Germany, the complaints body under § 13(1) AGG quickly runs into a conflict of interest here.

6. Career path

Junior → senior → lead → head of compliance → chief compliance officer. In practice the levels differ less in their topics than in their decision-making and reporting authority: at the lower levels the focus is on maintaining registers (Art. 30 GDPR), reviewing processor agreements (Art. 28 GDPR) and delivering training — what separates junior from senior here is the volume of that register work, not the authority. From lead level upwards, the time-bound decisions in an incident are added (Art. 33 GDPR, § 32 BSIG or § 34 NISG 2026), and from head level upwards the reporting line to the management. For the chief compliance officer level, a separate arrangement is advisable only where several jurisdictions — Germany and Austria with their different references, for example — or several companies come together; the delimitation from the head of compliance then runs via budget and personnel responsibility. This arrangement, too, is a question of organisation, not a statutory requirement. Practice recommendation: set the escalation threshold — from what point does the role report directly to the management — down in writing before the first incident forces the issue.

Deadlines attached to this role

Eight deadline triggers determine the working rhythm more strongly than any annual plan. All rows of the following table are statutory deadlines; practice rhythms appear separately below.

Practice rhythms without a statutory deadline that have proven themselves in SMEs: an annual update of the record of processing activities (Art. 30 GDPR) and a review of the technical and organisational measures (Art. 32 GDPR); an annual self-assessment of the effectiveness of the internal reporting channel modelled on ISO 37301:2021 — the checkpoints being compliance with the deadlines (§ 17 HinSchG, AT: §§ 9 and 13 HSchG), confidentiality (§ 8 HinSchG, AT: § 7 HSchG), the handling of anonymous reports, the training status and protection against reprisals (§ 36 HinSchG, AT: § 20 HSchG); this is best practice, there is no statutory obligation to carry out an annual audit of the reporting channel —, AGG staff training every 2-3 years, a quarterly meeting of the compliance role and a management review at the end of the year. Also not a deadline matter, but frequently misunderstood: in Germany the handling of anonymous reports is a 'should' provision under § 16(1) HinSchG, not an obligation.

Austria: same responsibilities, different references

The scope of the role does not change in Austria, but the legal bases and authorities do. The following comparison names the references that a role with DACH responsibility has to keep apart. The NISG 2026 (BGBl. I Nr. 94/2025) starts to apply on 1 October 2026; the Austrian references in this article take effect from that date.