When does data protection consulting include the appointment of an external Data Protection Officer?

The appointment of an external Data Protection Officer is not necessarily linked to data protection consulting.

On the one hand, the appointment may not be required by law—for example, if a non-public organisation employs fewer than 20 people who are constantly involved in the processing of personal data (see § 38 para. 1 BDSG).

On the other hand, the function of Data Protection Officer can also be performed by a suitable person within the organisation.

However, upon request, data protection consulting can also include the assumption of the role of external Data Protection Officer – even if there is no legal obligation to do so.

Note: This information is for general information purposes only and does not replace individual legal advice.