Section 38 BDSG (DPO Requirement)

German extension of the DPO requirement under Art. 37 GDPR

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

Section 38 of the German Federal Data Protection Act (BDSG) requires the appointment of a DPO where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data — stricter than Art. 37 GDPR.

What is Section 38 BDSG (DPO Requirement)?

Thresholds for the DPO requirement in the DACH region:

Germany: as a rule at least 20 persons constantly engaged in automated processing (§ 38(1) sentence 1 BDSG) OR the criteria of Art. 37 GDPR; regardless of headcount for processing subject to a DPIA or for commercial processing for the purpose of transfer or for market or opinion research (§ 38(1) sentence 2 BDSG)
Austria: Art. 37 GDPR only (no additional threshold; public authorities and bodies, large-scale regular and systematic monitoring as a core activity, large-scale processing of special categories under Art. 9 or of data under Art. 10 as a core activity)
Switzerland: Art. 10 nDSG — voluntary, but recommended

Practical example

A mechanical engineering company with 35 employees: 28 of them use CRM, ERP and email every day. The § 38 BDSG threshold is met — appointing a DPO is mandatory. A breach of the appointment obligation (Art. 37 GDPR / § 38 BDSG) is sanctioned under Art. 83(4)(a) GDPR: a fine of up to EUR 10 million or up to 2 % of total worldwide annual turnover, whichever is higher.

Frequently asked questions

Who counts as 'engaged in automated processing'?

Section 38 BDSG refers to persons who are 'constantly' engaged in the automated processing of personal data; the law sets no minimum number of minutes. In practice this usually covers everyone who regularly processes personal data in IT systems in their day-to-day work — often almost all office staff (practical assessment, not a statutory definition).

Is an external DPO sufficient?

Yes. The DPO may be a staff member of the company or fulfil the tasks on the basis of a service contract (Art. 37(6) GDPR). Practical assessment: expertise and independence speak for an external DPO, greater distance from day-to-day operations speaks against.

Is there a fine if no DPO is appointed?

The appointment obligation (Art. 37 GDPR / § 38 BDSG) falls under Art. 83(4)(a) GDPR: a fine of up to EUR 10 million or up to 2 % of total worldwide annual turnover, whichever is higher. The EUR 50,000 limit in § 43(2) BDSG applies only to breaches of § 30 BDSG (incorrect handling of requests for information), not to the obligation to appoint a DPO.