Data Protection Officer: When Is a DPO Required in 2026?

1. DPO obligation in Germany

Short answer: In Germany the obligation to designate arises as soon as one of five conditions is met. The first is § 38(1) sentence 1 of the German Federal Data Protection Act (BDSG): as a rule at least 20 persons constantly engaged in the automated processing of personal data. The four remaining conditions apply irrespective of headcount — a business with five employees can therefore be just as subject to the obligation as a corporate group. The addressee is not only the Controller: Art. 37(1) GDPR and § 38(1) BDSG expressly name the Data Processor as well.

Five alternative conditions — one is enough:

1. § 38(1) sentence 1 BDSG: Controllers and Data Processors shall designate a data protection officer where, as a rule, they constantly engage at least 20 persons in the automated processing of personal data. Why this is more than a number: the provision applies expressly 'in addition to Article 37(1)(b) and (c)' GDPR — it extends the EU baseline, it does not replace it. What to do: count the persons who are constantly engaged in automated processing and record the result with a date. § 38(1) sentence 1 BDSG
2. § 38(1) sentence 2 BDSG: irrespective of the number of persons employed, where processing operations are subject to a data protection impact assessment under Art. 35 GDPR, or where personal data are processed commercially for the purpose of transfer, anonymised transfer, or for purposes of market or opinion research. What to do: before every new processing operation, check whether a DPIA is required — the same check also determines the DPO obligation (standard cases see section 4). § 38(1) sentence 2 BDSG
3. Art. 37(1)(a) GDPR: the processing is carried out by a public authority or body (exception: courts acting in their judicial capacity). What to do: here the obligation follows directly from the status of the institution — the only question examined is whether a public authority or body is involved. Art. 37(1)(a) GDPR
4. Art. 37(1)(b) GDPR: core activity profiling or regular and systematic monitoring on a large scale; in official wording: the core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale. What to do: distinguish whether the monitoring is part of the business model or merely an ancillary activity. Art. 37(1)(b) GDPR
5. Art. 37(1)(c) GDPR: core activity processing of special categories (Art. 9) or of criminal-conviction data on a large scale. What to do: work through the catalogue of Art. 9(1) GDPR — it covers, among other things, health data, genetic data, biometric data for the purpose of unique identification, racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and data concerning sex life or sexual orientation. Art. 37(1)(c) GDPR Art. 9(1) GDPR

How the 20 persons are counted

The wording is decisive: 'as a rule at least 20 persons' who are 'constantly' engaged in the automated processing of personal data. The threshold therefore attaches to the activity, not to the form of contract: interns, working students, apprentices and marginally employed staff also count, provided they work with personal data. Practical recommendation: carry out the count along the systems in which automated processing takes place — HR system, CRM, accounting, ticketing system —, record the result with a reference date and a date, and review it again in hiring waves, seasonal peaks or when new systems are introduced. This is a practice rhythm, not a statutory deadline. At the same time, the list is the justification should the supervisory authority later ask why no DPO was designated.

If the designation is omitted despite the obligation, the framework of Art. 83(4) GDPR applies — up to EUR 10,000,000 or, in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher; the designation obligation of Art. 37 GDPR falls within the range of Articles 25 to 39 covered there.

2. DPO obligation AT/CH

Short answer: Austria has no numerical designation threshold — there the DPO obligation follows exclusively from Art. 37 GDPR (public authority/public body, core activity large-scale monitoring, core activity special categories). § 5 of the Austrian Data Protection Act (DSG) does not create any additional obligation. In Switzerland there has been no DPO obligation since the revised Data Protection Act (September 2023); appointment is now only recommended (Art. 10 nDSG). Germany is therefore the strictest of the three legal areas: § 38(1) BDSG applies expressly 'in addition to Article 37(1)(b) and (c)' GDPR (the individual conditions are set out in section 1) — a company with 20 employees engaged in automated processing is subject to the obligation in DE, but not in AT without an Art. 37 condition.

What § 5 DSG actually governs in Austria

The provision governs the position of the data protection officer once designated: the DPO and the persons working for the DPO are bound to secrecy, the DPO has a right to refuse to give evidence, and in the public sector the DPO is free from instructions in the performance of the tasks. Anyone examining the Austrian legal position therefore answers the 'whether' exclusively through Art. 37 GDPR and the 'how' through § 5 DSG. In addition, the duty of data secrecy under § 6 DSG applies to Controllers, Data Processors and their staff. In Austria, the Austrian Data Protection Authority may under § 11 DSG issue a warning instead of imposing a fine, in particular in the case of first-time infringements.

Practical recommendation for companies with sites in DE and AT: document the assessment separately. A joint DACH assessment regularly leads either to the German threshold of § 38(1) sentence 1 BDSG (as a rule at least 20 persons) being incorrectly transferred to Austria, or conversely to the stricter German rule being overlooked. Different authorities are competent in any case (section 7, step 5).

3. Internal or external?

Short answer: the external DPO is as a rule the cheaper and more independent solution (EUR 1,500-8,000 instead of EUR 50,000-100,000 per year), the internal one the faster and more closely informed — and the dual-role question should come before the cost calculation (see below).

The cost figures in this table are market figures from the first edition (as at 2 May 2026).

Three questions that carry the decision

First, the dual role. The DPO monitors compliance with the GDPR (Art. 39(1)(b) GDPR). Anyone who is at the same time responsible for that same area — typically IT management, HR management or the management board — is monitoring themselves. Practical recommendation: assign the role to a person without their own decision-making power over the purposes and means of processing, or award it externally.

Second, availability in an emergency. The 72-hour deadline for notifying a Personal Data Breach runs from the moment the Controller becomes aware of it, not from the completion of the internal assessment (Art. 33(1) GDPR). Practical recommendation: set out a response time and an escalation route for personal data breaches in the mandate contract — where the engagement is by the hour, this point determines whether the model holds up in an emergency.

Third, the group question. Under Art. 37(2) GDPR a corporate group may designate a single DPO, provided that the DPO is easily accessible from each establishment. In Austria an external DPO is permissible and more widespread than in Germany; there the duty of secrecy under § 5 DSG covers the DPO and the persons working for the DPO by operation of law (section 2).

4. Tasks of the DPO (Art. 39 GDPR)

Short answer: Art. 39(1) GDPR names five core tasks of the data protection officer ((a)–(e)): informing and advising the Controller, monitoring compliance with the GDPR (including awareness-raising and training of the staff involved), advising on data protection impact assessments (DPIAs), cooperating with the supervisory authority, and acting as the contact point for the supervisory authority. That data subjects may also consult the DPO does not follow from Art. 39, but from Art. 38(4) GDPR.

1. Informing and advising (Art. 39(1)(a) GDPR). Practical recommendation: record advice in text form with a date. In supervisory proceedings, the advisory trail is solid evidence that the role was not merely filled but actually exercised.
2. Monitoring compliance with the GDPR ((b)). In practice the first objects of examination are the evidence documents: record of processing activities, data processing agreements, technical and organisational measures, impact assessments. In practice the supervisory authority works through the same order — RoPA, then DPA, then TOMs, then DPIA; according to the BfDI activity report 2024, 85 % of the supervisory enquiries evaluated there begin with the submission of the record of processing activities.
3. Training of staff (part of (b)). Awareness-raising among the staff involved in the processing operations is part of the monitoring task. Practical recommendation: document attendance, date and content — in supervisory proceedings, what counts is what can be evidenced.
4. Advice on DPIAs ((c)). A DPIA must be carried out in advance where a processing operation — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons. Art. 35(3) GDPR names three standard cases: a systematic and extensive evaluation of personal aspects (profiling) producing legal effects, large-scale processing of special categories under Art. 9, and systematic monitoring of a publicly accessible area on a large scale. Why this counts twice: in Germany a processing operation requiring a DPIA triggers the DPO obligation irrespective of headcount (§ 38(1) sentence 2 BDSG).
5. Cooperation with the supervisory authority ((d)). Which authority is the point of contact depends on the legal area and the status of the body — the allocation for DE and AT is set out in section 7, step 5.
6. Contact point for the supervisory authority ((e)). In the event of a personal data breach, communication runs through the DPO. The practical workflow from the 72-hour procedure allocates the roles as follows: detection and activation of the crisis team in hours 0–2 (IT/SOC + compliance), containment and initial forensics in hours 2–8 (IT team), classification of the affected data types and risks in hours 8–24 (DPO + compliance), drafting the notification in hours 24–48 (DPO + management board), sending it and documenting the confirmation in hours 48–72 (DPO). Of this, only the deadline itself is laid down by law: without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33(1) GDPR).
7. Contact point for data subjects (Art. 38(4) GDPR). Requests under Articles 15 to 22 GDPR (access, rectification, erasure and others) must be responded to by the Controller without undue delay and in any event within one month of receipt; the period may be extended by two months where the request is complex or where there is a high number of requests, in which case the data subject must be informed within the first month, stating the reasons (Art. 12(3) GDPR).

The following documents and procedures name the data protection officer expressly or involve the DPO:

5. Costs + market prices for an external DPO

Short answer: market prices for external DPOs scale with headcount — from EUR 1,500 per year in a small business to EUR 50,000 per year in a large enterprise (scale below). The trigger for the obligation does not scale with it: company size and the designation obligation can diverge.

All price figures in this section are market figures from the first edition (as at 2 May 2026).

Why headcount is only half the calculation

In practice the workload of a DPO mandate is measured by the number and sensitivity of the processing activities, not by headcount — which is why company size and price can diverge. That size and obligation likewise diverge is shown by the example of a medical practice with eight employees whose core activity consists in the large-scale processing of health data: subject to the designation obligation under Art. 37(1)(c) GDPR; and in Germany a business with one processing operation requiring a DPIA is subject to it under § 38(1) sentence 2 BDSG irrespective of headcount.

Practical recommendation for comparing offers: tie the scope of services to the catalogue of tasks in section 4 — informing and advising, monitoring the evidence documents, training, DPIA advice, contact with the authority, contact point for data subjects — and additionally clarify whether sites in Austria are covered; there the Austrian Data Protection Authority is the point of contact (§ 18(1) DSG).

6. Protection against dismissal

Short answer: the data protection officer enjoys special protection in both legal areas, but under different provisions: in Germany under § 6(4) BDSG, which applies to non-public bodies via § 38(2) BDSG; in Austria directly under Art. 38(3) GDPR. The practical difference lies in the precondition — the German protection depends on the designation being mandatory.

Practical recommendation: state in the letter of appointment which of the five conditions from section 1 the obligation is based on. In Germany, precisely this allocation helps determine whether § 6(4) BDSG is applicable via § 38(2) BDSG.

7. DPO appointment checklist

Short answer: a complete DPO appointment takes eight steps — from checking the obligation under § 38 BDSG or Art. 37 GDPR, through the letter of appointment, notification to the supervisory authority and publication of the contact details, to the annual activity report.

1. Check the obligation: § 38 BDSG or Art. 37 GDPR. First the headcount (as a rule at least 20 persons, constant automated processing), then the four headcount-independent triggers from section 1. For Austrian sites the first step does not apply — there only Art. 37 GDPR counts.
2. Decide internal or external (costs + availability). The decision criteria and the three guiding questions are set out in section 3; the dual-role check should come before the cost calculation, because it can rule out internal candidates.
3. Draw up a mandate contract (external) or a letter of appointment (internal). The catalogue of tasks from section 4 belongs in both documents. For AT mandates, additionally reflect § 5 DSG.
4. Document the appointment in writing. Practical recommendation: include the date, the person, the scope of tasks and the condition that triggered the obligation; the direction of evidence follows the Accountability principle under Art. 5(2) GDPR.
5. Inform the supervisory authority (informal letter). Content (practical recommendation): name and contact details of the data protection officer, the designating body, the date of appointment, and whether the designation is internal or external. Which authority is competent depends on the legal area and the status of the body (table below).
6. Add the contact details to the Privacy notice on the website. For Austrian websites, additionally check whether the Austrian Data Protection Authority is named as the complaints body (Art. 13(2)(d) GDPR) — with its address and the complaints route.
7. Inform staff about the DPO. The DPO is at the same time the contact point for data subjects (Art. 38(4) GDPR) — employees also turn to the DPO with their own data protection concerns. The information therefore belongs in the same circulation as the training under Art. 39(1)(b) GDPR.
8. Annual DPO activity report to the management board. Practice rhythm, not a statutory deadline. Sensible contents are the points that are asked about in supervisory proceedings anyway: status of the record of processing activities, outstanding data processing agreements, training delivered, DPIA cases, personal data breaches.

Step 5 in detail — who the notification goes to:

Practical recommendation for the review rhythm: repeat the obligation check from step 1 once a year and additionally on every change — new systems, new sites, new processing activities, a change in headcount. For companies with a rapidly growing workforce, a quarterly review has proved useful. Both are practice rhythms, not statutory deadlines.