Your external DPO

In Germany, generally from 20 people who constantly process personal data by automated means (Section 38 BDSG). Part-time staff and trainees count. Regardless of headcount, the obligation applies if your processing requires a data protection impact assessment.

We take on 80% of the data protection effort. You need an internal coordinator who knows your processes and reports new projects, service providers, or requests to your DPO early.

No. Your company remains responsible, and your management makes the decisions. Your DPO advises, monitors compliance with the GDPR, and is the point of contact for the supervisory authority and data subjects.

You report the incident through the Digital Compliance Office. Your DPO assesses whether there is a reporting obligation and prepares the notification to the supervisory authority and, if necessary, to the data subjects. A 72-hour deadline applies.

Your new DPO moves the existing documents into the Digital Compliance Office, checks them for gaps, and notifies the supervisory authority of the change.