External DPO

Under § 38 para. 1 BDSG (German Federal Data Protection Act), a DPO is mandatory if you regularly employ at least 20 persons engaged in automated processing of personal data. Regardless of headcount, the obligation applies under Art. 37 GDPR for certain processing activities: for example if your core activity involves large-scale processing of special categories of personal data (health, genetic or biometric data), or you regularly and systematically monitor individuals at large scale (e.g. large-scale CCTV surveillance).

An external DPO brings broad experience from a variety of industries and company sizes. They are independent from internal hierarchies, have no interest in avoiding conflict, and can report openly. Additionally, there are no recruitment costs, salary costs, training costs, or risk of absence through illness or resignation. With AWARE7 there is an added benefit: our DPO brings IT security and data protection together - which is decisive in practice.

The external DPO monitors compliance with GDPR and other data protection regulations, advises management and staff, maintains the Record of Processing Activities (RoPA), reviews and negotiates DPAs with service providers, supports Data Protection Impact Assessments (DPIAs) and acts as the contact point for data subject requests and the supervisory authority. They regularly train your employees and report to management.

The cost of an external DPO depends on company size, sector and the scope of data processing activities. As a benchmark: an external DPO is significantly more cost-effective than an internal full-time position, where salary (approx. EUR 50,000-80,000/year), social contributions, training and absence risk apply. Contact us - we will provide an individual quote.

Yes. AWARE7 can be appointed as DPO. The GDPR expressly permits the appointment of an external DPO (Art. 37 para. 6 GDPR). There is no conflict of interest between our work as IT security consultants and the DPO function - quite the contrary: combining IT security and data protection is a concrete advantage for your organisation.

The appointment takes place in four steps: 1. Initial consultation to clarify your needs and the obligation to appoint. 2. Assessment of your current data protection situation. 3. Formal appointment and notification to the supervisory authority. 4. Ongoing support with regular status meetings. The entire onboarding process typically takes 2-4 weeks.

Your external DPO is the first point of contact. For reportable data breaches, they coordinate notification to the supervisory authority within the 72-hour deadline, document the incident and support communication with affected individuals. For access requests under Art. 15 GDPR, they ensure the legally required one-month deadline is met and the response is complete and accurate.

If you are legally required to appoint a DPO but have not done so, the supervisory authority can impose a fine - under Art. 83 para. 4 GDPR up to EUR 10 million or 2% of global annual turnover, whichever is higher. More important than the fine question: a DPO protects you against the far more costly consequences of actual data protection violations. We help you reach a legally sound position quickly.

Especially for small companies and mid-sized businesses, an external DPO is often the best solution. An internal full-time position is not financially viable, and data protection as a side task for an employee carries risks. An external DPO delivers professional expertise at predictable cost - no permanent employment, no absence risk, no conflict of interest.

AWARE7 serves companies across all sectors - from IT service providers and SaaS vendors to healthcare and financial services, through to manufacturing and the public sector. The combination of data protection and IT security expertise is a particular advantage in sectors with high requirements for technical and organisational measures.