KlarComply
DEENNL
Sign in Quick check
KlarComply
Quick check
DEENNL

Product

KlarComply platformStaff trainingCompliance kit (free)Quick check (free)AI labellingAI policy generatorVerify a certificateAI Officer courseDPO check (data protection)For individuals

Solutions

Beauty salonsHair salonsHotelsPhysiotherapy practicesDental practicesTrades businessesCar repair shopsAdvertising agenciesTax and accounting firmsLaw firmsEstate agentsAll industries
Pricing
For partners

Knowledge

All articlesLegal statusArticle 4: training obligationArticle 50: labellingPenalties under Article 99The AI Act for SMEsFAQ

Company

About KlarComplyContact & legal noticeLinkedIn

Account & legal

Sign in / My areaPartner sign-inLegal noticePrivacyTermsWithdrawal noticeDPACancel contracts hereWithdraw from contract here

Do we need a data protection officer?

Five questions, two minutes, and you get a reasoned result under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG), including a text module for your records. Free, no sign-up; nothing is transmitted, the check runs entirely in your browser.

1 · Where is your company based (or where do your staff work)?

2 · How many people at your company are permanently engaged in the automated processing of personal data?

Count every person who regularly works at a computer with customer, staff or supplier data, including part-time staff. The threshold comes from Section 38 BDSG and applies only to Germany.

3 · Does your core activity consist of large-scale, regular and systematic monitoring of individuals?

4 · Does your core activity consist of large-scale processing of special categories of data (health, religion, biometrics and so on) or of data relating to criminal offences?

5 · Are you a public authority or public body?

And the obligations that remain in any case?

With or without a data protection officer: the record of processing activities, data processing agreements, measures under Art. 32 and the demonstrable awareness training of your team remain your responsibility (accountability, Art. 5(2) GDPR). The free two-minute check shows where your company stands on the AI Act and data protection.

To the free two-minute check

Frequently asked questions

From when must a company appoint a data protection officer?

EU-wide, appointment is risk-based (Art. 37 GDPR): mandatory for public authorities and for core activities involving large-scale systematic monitoring or large-scale processing of special categories of data. In Germany, Section 38 BDSG adds a further rule: mandatory from 20 people permanently engaged in the automated processing of personal data. Malta and Austria have no such additional threshold.

Will the 20-person threshold of Section 38 BDSG be abolished?

Announced, but not decided: the Federal Modernisation Agenda of 4 December 2025 promises a bill repealing Section 38(1) BDSG by the end of 2026. As of 1 September 2026 no bill has been tabled, the threshold applies unchanged. As soon as that changes, it will be on our legal status page.

No data protection officer, do the data protection obligations then fall away?

No. Without a duty to appoint, all other obligations remain: the record of processing activities (Art. 30), data processing agreements (Art. 28), technical and organisational measures (Art. 32) and demonstrable staff training. Precisely then: document all the more.

This tool is a documentation and orientation aid, not legal advice. Legal status as of 1 September 2026; borderline cases (e.g. “core activity”, “large-scale”) should be clarified with a qualified adviser. No input is transmitted or stored.