Your External Data Protection Officer (DPO)

In general, it is not only a question of the number of employees. Even if you are not obliged to appoint a data protection officer, your company must still comply with all data protection requirements. A data protection officer is required in any case if one or more of the following criteria apply to your company:

• You have more than 20 employees
• You process special categories of personal data on a large scale (e.g. data about a person's ethnic origin, political opinions, religious beliefs or health).
• You use video surveillance or employ new technologies, e.g. algorithms or artificial intelligence.
• In almost all businesses that have a connection to personnel: personal data are transmitted, collected, processed or used on a business basis and this constitutes a core activity of the business‍.

The data protection officer has the following tasks:

• Advising and training data controllers, processors and employees on compliance with data protection regulations.
• Monitoring compliance with data protection regulations and strategies for the protection of personal data, as well as conducting data protection impact assessments.
• Data protection audit of your company.
• Cooperation and contact with the data protection authority.
• Advising management and specialist departments.
• Preparation of mandatory documents.

A part-time internal data protection officer invests 20% of his or her working time in data protection tasks. This can cost the company between 5,000 and 15,000 euros per year, depending on the effort involved.

If one hires a full-time internal data protection officer, the costs are the same as for the part-time data protection officer, but without a pro-rata salary calculation. The costs for full-time data protection officers can range from 45,000 to 65,000 euros per year, depending on the company and the tasks. The average investment is 55,000 euros.

The costs for external data protection officers vary greatly and depend on many factors. Lawyers and law firms can charge hourly rates of 250 EUR and more, while external data protection officers with a certificate of professional competence often earn somewhat less.

It is important to mention that an external data protection officer pays for many cost items, e.g. further training, working materials, and is basically liable for mistakes in the advice.

Our data protection solution offers your company, among other things:

• Support as an external data protection officer
• Support in the creation & review of data protection declarations, order processing agreements (AVV), the director of processing activities (VVT), technical organisational measures (TOM) and the most important data protection documents
• A comprehensive digital audit to identify data protection risks
• Online staff training
• An expert team of lawyers and legal experts to help you comply with data protection regulations

Based on your needs, we will create a customised offer and communicate it to you in a transparent way (no hidden extra fees). For more information see our pricing page.

If you are looking for an external data protection officer (DPO), there are a few things you should look out for.  Here are the most important points to tick off your checklist:

• Legal knowledge: Does the external DPO have solid experience in data protection? Is he/she an expert on the GDPR and/or other local regulations?
• Industry knowledge: Does the external DPO have experience in your specific industry? This can be particularly helpful if your industry has specific data protection requirements.
• A person or team of experts: Is the DPO part of a team of experts? If so, this means not only additional expertise but also increased availability.
• Soft skills: In the best case, the DPO should also have interdisciplinary skills such as good communication and teamwork. This makes cooperation much easier.
• Training and certification for your employees: Can the external DPO train your employees sufficiently? And can he issue them with a certification on completion of the courses?
• Price and transparency: Are the costs clear and transparent? Are there different package options that fit your budget?
• Digitalisation and simplification: Does the external DPO use modern, digital tools such as software and integrations? This can speed up processes and increase efficiency.
• Updates and flexibility: Can the external DPO adapt to changing requirements? In the area of data protection, it is often crucial to stay up to date, as laws and regulations can change.