Data Protection Academy » Data Protection Wiki » Data Protection Officer

An external data protection officer performs his tasks on a laptop computer

Data protection according to GDPR

Data Protection Officer Duties and Appointment

The data protection officer is the person responsible for coordinating and monitoring compliance with the requirements of the General Data Protection Regulation (GDPR). Many companies in the European Union are obliged to appoint a data protection officer. In the following article, we inform you about the obligation to appoint a data protection officer, the differences and the tasks of the data protection officer.

Content on the subject of data protection officer:

Whitepaper Data protection at company sites and persons in the data protection organisation

Whitepaper: Data protection at company sites and persons in the data protection organisation

In the whitepaper on data protection at company sites & persons in the data protection organisation you will find:

  • Get information on Legally permissible data transfers
  • Learn more about the Data protection relevant consideration of different company locations
  • Learn DSGVO-compliant Possibilities of Data transfer to third countries Know
  • Get background information on the Market place principle, third country and group privilege
  • Learn which people Members of the data protection organisation are

Unfortunately this content is currently only available in German. Please feel free to contact us for more information.

Types and responsibilities of data protection officers

There are data protection officers (abbreviated as "DPOs") for different areas of responsibility: at federal level there is the Federal Commissioner for Data Protection and Information Security (BfDI) Ulrich Kelber, in the individual federal states there are so-called state data protection officers and in companies there are company data protection officers. Company data protection officers can be divided into internal and external DPOs.

Federal Commissioner for Data Protection

The Federal Commissioner for Data Protection and Information Security is responsible for the processing of personal data of all federal public bodies as well as all non-public bodies, from the area of telecommunications and postal service companies. In addition, he advises private companies that fall under the Security Review Act and is the competent supervisory authority for the job centres. One of the most important tasks of the BfDI is to inform the German Bundestag and the public about developments in the private sector that are relevant to data protection.

State Data Protection Commissioner

The state data protection commissioners are the data protection commissioners of the respective federal states and are responsible for reviewing data protection in authorities and public bodies, within the respective federal state. They also act as supervisory authorities and monitor compliance with data protection law in companies, associations, self-employed persons and clubs in the federal state.

Company data protection officers

The company data protection officer supports companies in complying with data protection and implementing the GDPR. Unlike the Federal Commissioner and the State Commissioners, this is not a state institution, but rather an expert in the field of data protection who is responsible, among other things, for training employees, managing data protection measures or acting as an interface between the company and the supervisory authority.

Internal data protection officer

An internal DPO is directly employed by a company and has been appointed by the management as the person responsible for implementing corporate data protection. Often, employees are entrusted with the activity of data protection in addition to existing tasks, for which further training and a certain expertise in this area are necessary. If an existing employee is to be appointed as an internal DPO, it should be noted that the employee must not belong to the IT department, the HR department or the management. Otherwise, the employee would have to control himself/herself and there would be a conflict of interest.

External Data Protection Officer

An external data protection expert is an external consultant appointed by a company to implement operational data protection as the responsible person. The main difference to the internal data protection officer is that the external DPO is not directly employed by the company but also supports other companies in the implementation of the General Data Protection Regulation (GDPR). External data protection officers often have the necessary qualifications and experience, but usually need more time to integrate into the company structure.

Data Protection Officer

The tasks of the company data protection officer and the official data protection officer hardly differ from each other. The main difference between these two types of data protection officers is that the data controller is not, for example, a company from the private sector, but a public authority or public body.

Who must appoint a data protection officer?

The obligation to appoint a data protection officer applies in accordance with GDPR primarily to public authorities and public bodies. But also companies whose core activity is the particularly extensive processing of personal data or the processing of special categories of data (in accordance with Article 9 and the 10(GDPR), must appoint a data protection officer in accordance with the GDPR. (see Article 37 GDPR)

An opening clause in the GDPR offers each member state the opportunity to create stricter conditions for the appointment of an in-house data protection officer. In the new Federal Data Protection Act, for example, Germany has, among other things, regulated the obligation to appoint company data protection officers more strictly than in the GDPR.

Thus, the appointment of a data protection officer according to Art 38 BDSG compulsory for all companies in Germany, insofar as at least 20 employees (Federal Council decision on 20 September 2019) constantly deal with the automated processing of personal data.

In summary, as a private company, it is easy to assess whether the appointment of a data protection officer is necessary on the basis of three criteria. If at least one of the three criteria applies, there is a legal obligation to appoint a data protection officer. The criteria are:

  1. The number of employees who regularly and recurrently work with personal data is at least 20 (employees are also auxiliary staff, trainees, temporary workers or freelancers)
  2. Processing of a special category of personal data takes place. (This includes race, ethnic origin, political opinion, religious beliefs, trade union membership, health, sexual life or criminal behaviour - see Article 9 and the 10 GDPR)
  3. Personal data are transferred, collected, processed or used on a business basis (i.e. the core activity of the company consists of these processing operations).

The intentional or negligent failure to appoint a company data protection officer constitutes an administrative offence subject to a fine.

Even if the company is not subject to the obligation to appoint a data protection officer according to legal requirements, the regulations of data protection law must nevertheless be fully complied with. This poses a particular challenge for smaller companies, as they simply lack data protection expertise. In such cases it makes perfect sense to voluntarily appoint a data protection officer.

Tasks of the Data Protection Officer

As an expert in data protection, the data protection officer has the task of ensuring that the requirements of the General Data Protection Regulation in the company and to prevent data protection breaches. In Article 39 GDPR the tasks of the data protection officer are regulated in detail:

  1. Informing and advising the controller or processor and the employees carrying out processing operations about their obligations under this Regulation and under other Union or Member State data protection legislation;
  2. Monitoring compliance with this Regulation, other Union or Member State data protection legislation and the controller's or processor's personal data protection policies, including the allocation of responsibilities, awareness-raising and training of staff involved in processing operations, and audits thereof;
  3. Advice - upon request - in connection with the data protection impact assessment and monitoring of its implementation pursuant to Article 35 (https://help.robin-data.io/artikel-35-dsgvo);
  4. Cooperation with the supervisory authority;
  5. Acting as a contact point for the supervisory authority on issues related to the processing, including prior consultation pursuant to Article 36, and, if necessary, advice on any other issues.

By teaching, advising and assisting companies in many processes, such as the data protection impact assessment supports, the danger of Data Protection Breaches greatly reduced. Should a mishap nevertheless occur, the DPO helps to report it to the competent supervisory authority. The DPO acts as a contact point and mediator in the event of (queries) regarding data protection law from companies, supervisory authorities and data subjects.

Information and consultation

Data protection officers are obliged to provide information about the existing obligations under data protection law. This obligation exists both vis-à-vis the controllers as well as towards the employees. Especially employees who process individual-related data must be trained or sensitised in the handling of data, technical devices and with regard to the existing electronic dangers. Such instruction is possible, for example, through regular e-mail communication. Counselling also plays a major role and in this case means support in solving concrete problems.

Monitoring

As a branch of the supervisory authority the DPO also monitors compliance with all data protection requirements in the company or in an organisation. The DPO is responsible for the internal assignment of responsibilities and tasks to the person in charge, as well as for the sensitisation and training of employees, and for the corresponding review.

Creation of guidelines

In the company, the data protection officer also assists in the drafting of legal documents that are related to data protection law. These include company agreements, but also internal regulations and guidelines. As advisors, data protection officers support the preparation of data protection declarations, which serve the fulfilment of the data protection requirements of the Duty to inform . The creation of the data protection documentationwhich is decisive for the fulfilment of the obligations of proof and accountability under data protection law, is carried out by the Data Protection Officer.

Carrying out a data protection impact assessment

If certain data processing operations are carried out in the company, the performance of a data protection impact assessment to be carried out. In this case, the controller seeks the advice of the DPO and clarifies, for example, whether a data protection impact assessment is required. The DPO will also help with questions about the procedure, which will ensure that the DPIA is carried out properly.

Drawing up the register of processing activities

Both controllers and processors are legally obliged to create processing directories. However, these can become very extensive. A DPO can advise at this point and check the directory for its conclusiveness, for example. Often data protection officers work with Data protection management systemswhich can assist in the creation of the register of processing activities.

Data protection incidents and data subject enquiries

The support of a data protection officer is particularly helpful for important processes and reporting requirements. If a data protection breach occurs, there is not much time before it is reported to the responsible supervisory authority Accordingly, it is important to implement effective processes that let employees know when a data protection incident has occurred and how the DPO is to be involved. In doing so, the DPO acts as an advisor at the side of the data controller.

Employee training on data protection law

In the case of employee training in data protection law, a fundamental distinction must be made between briefings and training. While the data protection officer must instruct and advise employees, the data protection officer is responsible for the actual training. Due to the fluid boundary between training and information.If the training is to be provided, the DPO should at least be involved in the design of the training. Data Protection Officers are only obliged to supervise the implementation of training, but often it is the Data Protection Officers themselves who provide the training. These trainings can be either general or, if necessary, sector-specific.

Participation in employee checks

If there is a ban in a company, e.g. with regard to private internet use, or if there is a fear of misuse, it is necessary for the person responsible to intervene and carry out a check. In order to comply with the rights of employees, the DPO must be involved in these controls.

Consultation of the works council

Another task of the data protection officer is to advise the works council. In addition to providing technical advice, this also requires mediation skills.

External Data Protection Officer

You are welcome to contact us as external data protection officer (DPO) order. We also offer individual consulting services as well as audits and will be happy to provide you with a non-binding offer. You can find more information about our external data protection officers on our website.

To the DSB service overview

Internal versus external data protection officer

The Data Protection Officer may be appointed internally or externally. Internal data protection officers are employees of the company who usually devote themselves to other tasks in addition to their data protection activities. The advantage of an internal data protection officer is that they know the company processes well and probably does not have to familiarise themself with the structures. On the other hand, they will have to acquire extensive data protection expertise in order to do justice to their task. This usually goes hand in hand with costly training courses. In addition, care must be taken to ensure that an internal DPO is not subject to a conflict of interest, i.e. that they do not have to monitor themself. An external data protection officer must first familiarise themself with the company's processes, but brings profound data protection expertise and experience, which means they can probably advise with pragmatic solutions. Which of the two options is more beneficial for a company depends heavily on the requirements of a company.

Position of the Supervisor

In order to be able to fulfil their duties, the GDPR stipulates that a data protection officer must be properly involved at an early stage in all matters relating to the protection of personal data (Article 38 GDPR). To this end, the Data Protection Officer shall have access to all information, processing activities or other resources necessary for this purpose.

The Data Protection Officer may not receive any instructions concerning the performance oftheir duties, nor may they be removed or discriminated against in the performance of those duties. Internal Data Protection Officers even enjoy special protection against dismissal.

DPOs should therefore be able to perform their duties and tasks in complete independence, whether they are employees (i.e. internal data protection officers) or not.

In addition, the Data Protection Officer shall be subject to an obligation of secrecy or confidentiality in the performance of their duties.

Contact point for "internals" and "externals

Data protection officers are the contact persons for data protection issues. This applies both internally within the company for employers, employees and the works council, as well as for external persons. These include, among others, customers, suppliers and data subjects who want information on data protection issues. To enable external persons to contact the DPO, it is important that the contact details are easily accessible (e.g. on the website). In addition to the postal address, the e-mail address must also be provided, while the telephone number is not required.

Contact person of the supervisory authority

Also for the supervisory authority the data protection advisor is a contact person. They act as a kind of branch office of the competent supervisory authority and ensures that the data protection regulations are complied with within the company or organisation. The data protection advisor is the direct contact person for enquiries and inspections by the supervisory authority. Accordingly, it is necessary to notify the supervisory authority of the contact details of the DPO.

What qualifications does a data protection officer need?

The data protection officer, whether internal or external, must have a qualification/expert status. This must be proven by appropriate training and further education and confirmed by official test seals. Since data protection officers act as contact persons within the company as well as for supervisory authorities, communication skills should not be disregarded. This is also necessary when it comes to justifying and implementing proposals for solutions and improvements within the company.

However, concrete specifications with regard to knowledge or training are neither in the GDPR nor provided for in the Federal Data Protection Act. Therefore, in principle, anyone can become a data protection officer. However, with regard to the expertise of a data protection officer, it is advisable to have further interdisciplinary knowledge in addition to knowledge in the area of data protection and data protection law.

This knowledge should cover the areas of risk, project and quality management as well as information security. Furthermore, practical skills such as setting up a data protection management system in companies or public authorities and experience in the consulting environment are advantageous.

Costs for a data protection officer in the company

The appointment of a data protection officer is always associated with costs. In terms of costs, there are differences between the internal and external appointment of a data protection officer. The internal further training of an employee or the new appointment of an internal data protection officer are compared to the monthly costs as well as individual consultation by an external data protection officer. The costs for an external data protection officer depend on the extent to which the company processes personal data or what kind of personal data is processed and how large the company is and how complex its corporate structure is. Therefore, it is hardly possible to make a general statement about the costs of an external data protection officer.

If you are interested in the costs of an external data protection officer for your company in particular, we will be happy to provide you with an offer free of charge and without obligation.

Personal liability of a Data Protection Officer

In terms of data protection law, the responsible body is always the company itself. The data protection officer has, according to Article 39 GDPR, however, clearly defined tasks, including a comprehensive duty of control. If a breach of data protection becomes serious, high fines may be imposed. If it can be proven that the Data Protection Officer has neglected their duties, this results in claims for damages against them.

Internal data protection officers are employees and are therefore subject to labour law with their liability. However, the following also applies here: whoever acts with intent or gross negligence is regularly liable alone and in full. In the case of normal negligence, the burden is usually shared between employer and employee and only in the case of slight negligence is the internal Data Protection Officer exempted from liability.

The situation is similar for external data protection officers, except that they are of course not subject to the regulations of labour law. As a rule, therefore, external data protection officers are fully liable to the injured party even in cases of slight negligence.

The liability of a data protection officer is an issue that has not yet received much attention. This is because, in practice, fines and therefore also claims for damages have not yet played a major role. However, with increasing regulations on fines, it will certainly become more important in the future.

If the data protection officer has been appointed, the controller must make the contact details public and notify the supervisory authority of the appointment. In the case of groups of companies, a joint company data protection officer may also be appointed.

What are the penalties for not appointing a data protection officer?

If a company fails to comply with its obligation to appoint a data protection officer, it may be liable to prosecution under the Data Protection Act. Art. 83 para. 4 Fines of up to €10 million or 2% of the total annual turnover achieved worldwide in the previous financial year, whichever is higher.

Information from the data protection supervisory authorities

Checklist Appointment of Data Protection Officer

  • Duty to appoint data protection officer

    Under certain circumstances, there is an Obligation to order for companies. Therefore, check whether your company is legally obliged to appoint a data protection officer.

  • Voluntary appointment of a DPO

    If your company is not legally obliged to appoint a DPO, there are still reasons why a voluntary appointment makes sense. For example, if you as the controller want to comply with the requirements of the GDPR and do not have the necessary know-how yourself. Furthermore, every company - irrespective of the legal obligation to appoint a data protection officer - must document the data protection measures taken and be able to prove them in the event of an audit. An external data protection officer can support you with data protection documentation. Therefore, check whether you want to voluntarily appoint a DPO to help you implement the requirements of the GDPR.

  • Appointment of a DPO

    Appoint or nominate a suitable external or internal data protection officer.

  • Information on the DPO

    Publish the contact information of your data protection officer on your website.

  • Official message of the DSB

    After appointing a data protection officer, notify the competent supervisory authority the contact details of your data protection officer. This off-target notification of the data protection officer must also be made if you change your data protection officer.

Caroline Schwabe
Latest posts by Caroline Schwabe (see all)

This might interest you too:

The activity report according to the GDPR

Templates, whitepapers and implementation of the activity report according to the GDPR. Create the activity report automatically in just a few steps.
Read more

Erasure concept according to the GDPR

Samples, templates and examples for your GDPR erasure concept according to DIN 66398. Automatically create the erasure concept.
Read more

Record of processing activities

List of processing activities according to Art. 30 GDPR. Explained step by step with extensive information. Data protection made easy.
Read more