External data protection officers: What costs can be expected?

A Data Protection Officer takes on a legally defined set of tasks, which includes, in particular, advisory, informational, and monitoring duties (see Art. 39 GDPR).  

The operational implementation of data protection measures is usually carried out by the respective departments of the organisation.  

Depending on the risk involved in the processing activities, the effort required to perform these tasks can vary greatly:  

• For standard processing without any particular risks, the role can be fulfilled with a manageable amount of effort.  

• Sensitive or extensive processing activities require particularly careful examination and documentation.  

The costs of appointing an external Data Protection Officer must therefore be calculated on a case-by-case basis. In many cases, it is more cost-effective to hire an external service provider than to appoint and train a suitable person internally.  

Note: This information is for general guidance only and does not constitute individual legal advice.