Data Protection Officer — when required?
Obligation to appoint a DPO in DE and AT.
Definition
DE: mandatory where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data (§38 of the German Federal Data Protection Act (BDSG)), regardless of headcount where processing is subject to a data protection impact assessment (§38 BDSG), OR where core activities are involved (Art. 37 GDPR). AT: only Art. 37 GDPR (no national threshold). Practice assessment, not a statutory threshold: an external DPO is advisable from 50 employees. In the GDPR Kit: DPO appointment template plus list of duties.