H&M
35.3 million EUR
2020 · HmbBfDI
Extensive employee monitoring in the service center. Personal data collected for years without a legal basis.
Interactive checker
5 questions. A clear assessment.
Answer Yes or No. For every "Yes" on a trigger, the checker immediately shows whether the obligation applies, and on which legal basis.
DPO obligation checker
5 questions based on Section 38 BDSG and Art. 37 GDPR. No sign-up, no data stored.
This assessment does not replace legal advice. When in doubt, engage a DPO or a specialist IT lawyer.
What a violation risks
Art. 83(4) GDPR
up to 10 million EUR
or 2% of worldwide group turnover
, whichever is higher
Pure appointment violations are 5,000 to 50,000 EUR in practice. But: a missing DPO function points to structural data protection deficits, and those draw further violations into the proceedings.
Three prominent cases
Deutsche Wohnen
14.5 million EUR
2019 · BlnBDI
Personal data of former tenants kept without necessity. Violation of storage limitation (Art. 5 GDPR).
AOK Baden-Württemberg
1.24 million EUR
2020 · LfDI BW
Data breaches in a member prize draw. Addresses processed further without valid consent.
Sources: press releases of the relevant supervisory authorities. The amounts stated are the fines originally imposed.
The legal bases
One EU norm. One German tightening.
Art. 37 GDPR defines three triggers for all of Europe. Section 38 BDSG adds the employee threshold for Germany, which no other EU country has in this form.
Art. 37 DSGVOEU
Three constellations, obligation applies.
- a
Public authority / public body
Federal government, states, municipalities, public-law institutions. Exception: courts acting in their judicial capacity.
- b
Core activity monitoring
Large-scale, regular, systematic monitoring. Behavioral targeting, location tracking, AI profiling, large-scale web analytics.
- c
Core activity special data
Large-scale processing of health, biometric, genetic, religious or trade union data.
§ 38 BDSGGermany only
A 20-person threshold on top.
Beyond the GDPR, Section 38(1) BDSG requires a DPO as soon as as a rule at least 20 people are constantly engaged in the automated processing of personal data.
"Working students, temps and interns count too if they regularly work in the CRM, ERP or newsletter tool. The threshold is reached faster than most people think."
2019 update: the old 10-person rule was raised to 20 with the BDSG reform. Anyone planning with the 10-person threshold is using outdated figures.
Even without an obligation
Three reasons to appoint one voluntarily.
Investor hygiene factor
By Series A at the latest, VCs expect a DPO plus records of processing and a DPIA workflow. Early structures cost less than retrospective remediation.
Enterprise sales readiness
Large customers require proof of an appointed DPO during vendor onboarding. Without a DPO, you fail at the first compliance question.
Growth threshold
With rapid hiring, the 20-person threshold tips within 6–12 months. Organizing it retroactively is unpleasant, doing it proactively is cheap.
What does a voluntary DPO cost?View costs
Frequently asked questions about the obligation
From how many employees do I need a Data Protection Officer?
Under Section 38 BDSG from 20 people who constantly process personal data in an automated way. This threshold applies in addition to Art. 37 GDPR. Public authorities, companies with a monitoring core activity or large-scale processing of special categories of data need a DPO regardless of headcount.
Does the old 10-employee rule still apply?
No. The threshold was raised from 10 to 20 people in 2019 with the BDSG reform. Anyone still planning with the old value is using outdated criteria.
Do working students and interns count toward the 20-person threshold?
Yes, provided they regularly (not just sporadically) work with personal data in an automated way. This includes temps, fixed-term staff and interns if they enter data, e.g. in the CRM, ERP or marketing tool.
Can our managing director be the DPO?
No. Art. 38(6) GDPR prohibits conflicts of interest. Managing directors, compliance officers, IT managers and HR managers are excluded because they themselves decide on data processing and would then be controlling themselves.
How quickly must I appoint a DPO after the obligation arises?
Without undue delay, that is, without culpable hesitation. In practice, 4 to 8 weeks until appointment and notification to the supervisory authority is still tolerable; after that, the fine risk rises significantly.
Does the appointment have to be formally documented?
Yes. Written appointment, notification to the relevant supervisory authority, publication of contact details (e.g. in the privacy policy). We provide the appointment text upon mandating.
Request an external Data Protection Officer (DPO)
We match you with a certified DPO from the Kopexa partner network, matched to your industry, location and language. Response within one business day.
A partner network, not a lone consultant
Access to certified DPOs with a range of industry specializations.
Complete GRC suite in the Pro plan
Kopexa Pro (599 EUR/month): unlimited frameworks, OSCAL support, vendor and asset management, cross-framework mapping, audit & assessments. Not just DPO tooling.
Transparent flat-rate pricing
DPO flat rate and platform license shown separately. No hidden tool costs.
More in the hub
External Data Protection Officer (DPO)
Overview: what an external DPO does, when one is mandatory and how the Kopexa partner network places them.
Cost & packages
Pricing models for external DPOs compared: hourly fee, monthly flat rate, packages by company size.
Locations
External DPOs by region: Berlin, Munich, Stuttgart, Cologne, Bremen and more.