Data protection officer under the GDPR and the BDSG

Both Article 37 of the General Data Protection Regulation (GDPR) and section 38 of the German Federal Data Protection Act (BDSG) require certain companies to designate a data protection officer. These are companies that meet one of the following three conditions:

• As a rule, at least 20 persons are constantly engaged in the automated processing of personal data.
• The core activities of the company consist of processing operations which require regular and systematic monitoring of data subjects on a large scale.
• The core activities of the company consist of processing special categories of personal data under Article 9 of the GDPR, or data on criminal convictions, on a large scale.

An external data protection officer works independently and takes no instructions on how to carry out the role. That is precisely what makes the officer decisive in preserving the confidentiality and integrity of personal data. We act as your external data protection officer and support you in meeting every legal requirement in full.

As your external data protection officer we advise the management on compliance with data protection law, as set out in Article 39 of the GDPR, and put the legal requirements into the organisational structures and processes of the company.

We monitor compliance with the data protection principles, run awareness raising and training for staff, and are the point of contact for data subjects and for the supervisory authority.