Data Protection Officer (DPO)

Mandatory function under Art. 37 GDPR and § 38 BDSG

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

The Data Protection Officer (DPO) under Art. 37-39 GDPR is the central data protection function within a company. Mandatory: under § 38(1) of the German Federal Data Protection Act (BDSG) where, as a rule, at least 20 persons are permanently employed in the automated processing of personal data; under Art. 37(1) GDPR, among other cases, where the core activities involve regular and systematic monitoring on a large scale or large-scale processing of special categories of data.

What is a Data Protection Officer (DPO)?

DPO tasks (Art. 39 GDPR): informing and advising, monitoring compliance, training, advising on DPIAs, cooperating with and acting as the contact point for the supervisory authority and data subjects. There is a duty to ensure independence, sufficient resources and direct reporting to senior management.

Protection against dismissal in Germany under § 38(2) in conjunction with § 6(4) BDSG, where the appointment is mandatory — dismissal only for good cause; removal from office only by analogy with § 626 of the German Civil Code (BGB).

Duty to appoint: Germany and Austria

The EU-wide basic cases follow directly from Art. 37(1) GDPR: a DPO must be appointed in any event by public authorities or public bodies, where the core activity consists of regular and systematic monitoring of data subjects on a large scale, or where the core activity consists of large-scale processing of special categories of data (Art. 9 GDPR) or of data relating to criminal convictions (Art. 10 GDPR). The national arrangements differ, however:

Germany

In addition to Art. 37(1)(b) and (c) GDPR, controllers and processors must appoint a DPO under § 38(1) BDSG where they permanently employ, as a rule, at least 20 persons in the automated processing of personal data. Regardless of the number of persons, the obligation applies where processing operations are subject to a data protection impact assessment under Art. 35 GDPR, or where data are processed commercially for the purpose of transfer, of anonymised transfer, or for purposes of market or opinion research. Protection against dismissal follows from § 38(2) in conjunction with § 6(4) BDSG. Competent supervisory authority: the Land data protection authority.

Austria

Austria does not provide for any numerical appointment threshold beyond Art. 37 GDPR — in particular, there is no 20-person limit. The duty to appoint follows directly from Art. 37 GDPR. In addition, § 5 of the Austrian Data Protection Act (DSG) provides that the data protection officer and the persons working for them are bound to secrecy, and that in the public sphere the data protection officer is free from instructions in carrying out their tasks. Competent supervisory authority: the Austrian Data Protection Authority (Datenschutzbehörde).

Practical example

Practical set-ups:

External DPO for an SME: fee depends on company size, sector and scope of support — to be clarified through comparative quotes
Internal DPO: effort depends on the share of working time for the function and on the resources to be provided under Art. 38(2) GDPR, including those needed to maintain expert knowledge
Group DPO: a shared function is permitted (Art. 37(2))

Frequently asked questions

Does the DPO have to be legally qualified?

No. Art. 37(5): 'on the basis of professional qualities and expert knowledge'. In practice: certified data protection professionals (TÜV, GDD).

Can the roles of IT manager and DPO be combined?

There is a risk of conflict — the IT manager decides on processing, the DPO monitors it. The Court of Justice of the EU in C-453/21 confirmed: a dual role is possible only where no conflict situation arises.

What should be done if the DPO post is vacant?

Appoint a successor without undue delay, publish their contact details and communicate them to the supervisory authority (Art. 37(7) GDPR). If a mandatory appointment is not made, the fining framework of Art. 83(4)(a) GDPR applies.