The new General Data Protection Regulation (GDPR) has been in force since May 25, 2018 and for the first time there is a Europe-wide obligation to appoint a company data protection officer. This is binding if a company carries out an activity that requires special control from a data protection point of view (e.g. processing of special data such as health data) or if more than ten people in a company are constantly busy with the automated processing of personal data.

The Second Data Protection Adaptation and Implementation Act EU (2. DSAnpUG-EU) and the change in the Federal Data Protection Act (BDSG) have led to new requirements since 2020 as to when a data protection officer (DSB) must be appointed. Instead of the previous ten people, at least twenty people now generally have to constantly deal with the automated processing of personal data.

The obligation to appoint a data protection officer does not apply in cases where the legislature considers the risk to the personal rights of a data subject to be low. This is the case if processing only takes place occasionally, no special categories of personal data are affected and are not likely to result in a risk to the rights and freedoms of those affected. All of these conditions must be cumulative; therefore, it is rare that a company that is inherently within the scope of the GDPR will benefit from this exception.

If a company fails to meet its obligation to appoint a data protection officer, fines of up to 10,000,000 euros or 2% of the company's annual global turnover, whichever is greater, can be imposed. A violation of a corresponding obligation is easy to recognize, since the data protection officer must be officially appointed and reported to the data protection supervisory authority. Furthermore, he must be named in the data protection declaration as a contact person for the topic of data protection.

By looking after several clients, the external data protection officer often has more practical experience than his internal colleague and can therefore work more effectively. The internal employees can thus concentrate on their core competencies and the employer circumvents the protection against dismissal of a company data protection officer. Furthermore, the regular training and further education costs for your company are eliminated. In the event of illness, vacation or further training, a representative is available at no additional cost to the client. Problems (including when audited by supervisory authorities) due to a lack of specialist knowledge or reliability (conflicts of interest) are avoided. The costs can be easily controlled and calculated through project-related activities and needs-based use.