The Data Protection Officer: when appointment is mandatory — and what the law actually says in 2026

Few data protection questions are asked as often — and answered as wrongly. The answer has two layers: a European one that asks about risk, and a German one that simply counts people. And around that German threshold there has been an announcement since late 2025 that many already treat as law. It is not.

By Patrick de Kathen, Founder of KlarComply · Reviewed on 1 September 2026

The EU rule: Art. 37 GDPR asks about risk, not size

Across the EU, appointment is mandatory in only three cases: for public authorities, where the core activity involves large-scale, regular and systematic monitoring of people, and where the core activity involves large-scale processing of special categories of data — health data, for instance. The decisive words are core activity: a trading company keeping a customer database processes data as a means to an end, not as its business model. Under the EU rule, a typical sales, trading or trades SME does not need a Data Protection Officer.

The German add-on: Section 38 BDSG counts people

Germany used its opening clause: companies that constantly employ at least 20 people in the automated processing of personal data must appoint a DPO — regardless of risk. Everyone who regularly works with customer, staff or supplier data on a computer counts, part-time staff included. This matters to any company with staff in Germany; Malta, Austria and the Netherlands have no such extra threshold — there, Art. 37 alone decides.

No DPO does not mean no data protection

This is the most common misunderstanding. The appointment duty is one duty among many. Without a DPO, everything else remains: the records of processing activities (Art. 30), data processing agreements (Art. 28), technical and organisational measures (Art. 32) — and the duty to demonstrate all of it (accountability, Art. 5(2)). Trained staff are one of those demonstrations. Whoever needs no DPO must document all the more that the organisation stands anyway.

Internal or external?

Both are permitted. Internally, the person needs expertise and must be free of conflicts of interest — managing directors, heads of IT and heads of HR are regularly ruled out because they would supervise themselves. Externally, many SMEs buy the role as a service. In both cases the appointment is notified to the supervisory authority. There is no state licensing scheme for DPO expertise anywhere in the EU; privately issued qualification certificates are the market standard.

Frequently asked questions