External data protection officer

Many companies are required to designate a data protection officer – and have nobody in-house with the necessary expertise, free from conflicts of interest and with the time to do it. An external data protection officer solves that: you get the expertise without creating a position, and the role does not depend on your staffing.

We are currently designated as external data protection officers for clients in Rhineland-Palatinate and North Rhine-Westphalia. Because we design and operate IT systems ourselves, we assess technical measures from our own practice, not just against a checklist.

Do you need a data protection officer?

Under § 38 BDSG, a data protection officer must be designated if, as a rule, at least 20 persons are constantly involved in the automated processing of personal data. Regardless of headcount, the obligation also applies if

• processing operations require a data protection impact assessment,
• personal data is processed commercially for the purpose of transfer or for market and opinion research,
• your core activities consist of large-scale, regular and systematic monitoring of individuals (Art. 37 GDPR), or
• your core activities consist of large-scale processing of special categories of data, such as health data (Art. 37 GDPR).

The German federal government has announced plans to abolish the national 20-person threshold. The obligations of the GDPR itself – records of processing activities, information duties, data subject rights, reporting of data breaches – remain unaffected. Even a company that no longer has to designate a data protection officer therefore still needs someone who keeps an eye on these obligations. Whether and to what extent you are affected is something we clarify in a first conversation.

Why external?

• Expertise from day one, without training your own staff
• No conflicts of interest: management, the head of IT or HR can usually not take on the role themselves
• No special protection against dismissal, as enjoyed by internally designated data protection officers (§ 38 (2) in conjunction with § 6 (4) BDSG)
• Predictable costs instead of an additional position

What we take on as your data protection officer

• Informing and advising management and employees on their data protection obligations
• Monitoring compliance with the GDPR, the BDSG and your internal data protection policies
• Training and awareness-raising for staff
• Advice on new processing operations and data protection impact assessments before anything is introduced
• Review of data processing agreements and service providers
• Point of contact for data subjects who request access or wish to complain
• Support with data breaches, including assessing the 72-hour reporting obligation
• Cooperation with the competent supervisory authority (in Rhineland-Palatinate the LfDI, in North Rhine-Westphalia the LDI NRW)

How we work

We start by taking stock: which processing operations exist, what documentation is in place, where are the gaps? From that we draw up an action plan, ranked by risk and effort. After the designation, our contact details have to be published and communicated to the supervisory authority (Art. 37 (7) GDPR) – we help you with that, too.

During ongoing support we are available when a question comes up, not only at the next appointment. Much can be settled by phone or video call; we come on site where the matter calls for it – for audits, training sessions and inspections.