When is a DPO mandatory in Germany? The 20-person rule

A data protection officer is mandatory in Germany when a relevant GDPR or BDSG appointment trigger applies. For non-public bodies, one trigger is normally employing at least 20 persons constantly engaged in automated personal data processing. Other triggers can require an appointment below that threshold.

You therefore need to examine processing activities and actual responsibilities, rather than total workforce size alone.

This guide focuses on private organisations assessing whether they need a data protection officer, known in German as a Datenschutzbeauftragter or DSB. It explains the legal framework, the counting question and a practical way to organise the assessment.

What rules determine whether a DPO is mandatory?

Germany’s rules combine GDPR Article 37 with additional requirements under § 38 BDSG.

A controller determines the purposes and means of processing personal data. A processor handles personal data on a controller’s behalf. Appointment requirements can apply to either.

Use the following overview to identify the relevant questions:

The BayLDA appointment overview brings together the private-sector triggers. The European Commission’s obligations guide also explains the public-authority rule.

How does Germany’s 20-person rule work?

The first sentence of § 38(1) BDSG concerns organisations that normally employ at least 20 persons constantly engaged in automated personal-data processing.

Read the conditions together:

• “In der Regel” concerns the usual situation.

• “Mindestens 20 Personen” includes exactly 20 persons.

• “Ständig” qualifies their involvement in the processing.

• “Automatisierte Verarbeitung personenbezogener Daten” identifies the relevant processing activity.

A count of all staff does not show how those conditions apply. Nor does a list of everyone with a laptop.

Examine actual tasks

Start with responsibilities. What information does each role handle? Is the relevant processing a substantial part of the work, or only incidental?

In its FAQ guidance dated 10 February 2026, BayLDA interprets “in der Regel” by reference to usual staffing, disregarding short fluctuations. It explains “ständig” through the focus of the person’s work.

That is authority guidance on interpretation. Use it with the statutory wording and your organisation’s facts.

For your assessment, a task description is more informative than a department name. Record what the person actually does before deciding whether their role belongs in the count.

Who counts towards the threshold?

BayLDA gives examples distinguishing personnel or financial-accounting work from subordinate digital activities in predominantly manual work.

These examples are not blanket exclusions for entire occupations. Changed responsibilities can change the assessment.

Handle uncertain cases explicitly

This overview does not resolve every worker-category or corporate-group question. If your count depends on part-time staff, trainees, agency workers, freelancers, volunteers or separate legal entities, obtain guidance addressing that specific arrangement. Do not assume a full-time-equivalent formula or automatic group aggregation.

A useful internal record would identify:

• The role and actual processing tasks.

• Why you included or excluded it.

• The facts supporting that decision.

• Questions requiring clarification.

This is a recommended assessment method, not a prescribed statutory form.

When is a DPO required below 20 qualifying persons?

There are independent processing-based triggers. Two distinctions are especially useful: the GDPR’s core-activity tests and Germany’s additional BDSG conditions.

Core activities and large-scale processing

The GDPR tests involve core activities requiring large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-conviction and offence data.

The EDPB’s DPO guide explains that core activities are central to the organisation’s objectives. Large scale involves factors such as the number of individuals, data volume, duration and geographical scope.

A sector name alone does not answer these questions. The EDPB distinguishes hospital patient-data processing from a single general practitioner’s processing when illustrating scale.

Ask what processing occurs and how the relevant legal conditions fit. Do not turn “handles some sensitive data” into an automatic conclusion.

Processing requiring a DPIA

For non-public bodies, § 38 BDSG requires appointment independently of qualifying-person numbers where processing is subject to a data protection impact assessment under GDPR Article 35.

A data protection impact assessment (DPIA) examines the risks of processing to individuals. First establish whether the proposed processing requires one. Do not assume every new software project does. The European Commission’s guidance explains the high-risk basis of DPIAs and relevant exceptions.

Specified commercial-processing purposes

The BDSG also covers personal data processed geschäftsmäßig for transmission, anonymised transmission, or market or opinion research. Assess that German statutory term in context; a shorthand reference to commercial processing should not replace the legal test.

Assess the statutory condition rather than translating it into “every business that shares data needs a DPO”. Routine use of a service provider should not be used as a shortcut to that conclusion.

Three examples of appointment assessments

The following scenarios are hypothetical. Their conclusions depend on the stated assumptions.

Example 1: Exactly 20 qualifying persons

Consider a private organisation that normally employs exactly 20 persons constantly engaged in automated personal-data processing.

Assessment: On those assumed facts, the numerical BDSG trigger applies. “At least 20” includes 20.

Example 2: Twenty-five staff, fewer than 20 qualifying persons

Consider an organisation with 25 staff. Its task-based assessment identifies fewer than 20 persons meeting the relevant processing conditions.

Assessment: Total workforce size alone does not establish the numerical trigger. The organisation must still assess the independent GDPR and BDSG triggers before concluding that appointment is unnecessary.

Example 3: A smaller organisation requiring a DPIA

Consider a private organisation with eight qualifying persons. It carries out processing that requires a DPIA under Article 35.

Assessment: The independent BDSG DPIA trigger requires appointment. The lower headcount does not remove that requirement.

The examples show why a workforce count and a processing assessment answer different parts of the appointment question.

How to check your organisation’s appointment requirement

Use this recommended sequence to organise the assessment.

1. Establish the organisation’s status. Identify whether the public or non-public framework applies.

2. Review the GDPR triggers. Examine core activities, monitoring and relevant large-scale processing.

3. Review independent BDSG triggers. Check DPIA requirements and the specified commercial-processing purposes.

4. Assess the numerical condition. Examine usual staffing and actual qualifying responsibilities.

5. Record the outcome and uncertainty. Identify the evidence and obtain clarification where necessary.

If a trigger applies, proceed to appointment arrangements. Where no trigger is identified, retain the basis for that conclusion rather than treating it as a permanent exemption.

Keep a short assessment record

This format is a practical recommendation. Revisit the assessment when staffing responsibilities, processing activities or relevant requirements change.

What should you do if an appointment is required?

Arrange a suitable appointment when the duty applies; do not treat the checklist or future training as a reason to defer it.

A DPO needs appropriate expertise, independence and resources. An internal employee or an external service arrangement may fulfil the role, subject to the relevant requirements. Other responsibilities must not create a conflict of interest.

The organisation must publish the DPO’s contact details and communicate them to the competent supervisory authority. It retains responsibility for compliance. These points are explained in the BayLDA overview and EDPB guide.

Our Data protection officer certification in Germany: Requirements, skills and career paths explains how training relates to expertise and suitability for the role.

Preparing someone for the role?

Review the Data Protection Officer (DPO) Certification Training from the German Compliance Institute. Compare its curriculum, assessment and certificate details with the preparation the candidate needs.

Completing training does not automatically establish suitability for a particular appointment.

View DPO training details.