Glossary

Data Protection Officer (DPO)

What is a data protection officer?

A data protection officer is a competent person within a company or organization who is responsible for ensuring compliance with data protection regulations. He or she monitors the processing of personal data and advises the management and employees on all matters relating to data protection. The legal requirements and tasks of the data protection officer are regulated in the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

Data protection officers can be employed internally or commissioned externally. They act as an interface between the company, the data subjects and the responsible supervisory authorities and thus make a significant contribution to the legally compliant processing of personal data.

 

What does a data protection officer do?

The tasks of a data protection officer include in particular:

  • advising the management and employees on all data protection issues
  • monitoring compliance with data protection regulations and internal data protection guidelines
  • training and sensitizing employees to the secure handling of personal data
  • the implementation and documentation of data protection impact assessments
  • cooperating with the competent supervisory authority and acting as a point of contact for data subjects

In addition, the data protection officer supports the introduction of new data processing procedures and ensures that existing processes are continuously reviewed and adapted. The aim is to avoid data protection violations and to protect the rights of data subjects in the best possible way.

When is a data protection officer required by law?

The obligation to appoint a DPO arises from:

  • 37 para. 1 GDPR:
    • If the core activity of the company consists of the extensive automated processing of personal data,
    • or special categories of data (e.g. health data) are systematically processed,
    • or public authorities process data (except courts).
  • § 38 BDSG specifies further cases, e.g. from 20 persons who are involved in the automated processing of personal data.