External Data Protection Officer

External Data Protection Officer, in Frankfurt am Main, the Rhine-Main region and across Germany.

Appointed quickly and qualified, with no long-term commitment.

To the packages ↓

What we deliver

From obligation to advantage.

As your external Data Protection Officer we set up a modern data protection management system, act as your contact for supervisory authorities and train your team.

  • Appointment as external Data Protection Officer and notification to the competent authorities (Art. 37 GDPR)
  • Assessment of the current state and gap analysis (baseline review)
  • Review and creation of the record of processing activities (Art. 30 GDPR); review and drafting of privacy notices (Art. 13 GDPR, Art. 14 GDPR)
  • Internal policies for employees
  • Supplier assessment, review of service providers and data processing agreements (Art. 28 GDPR)
  • Use of our cloud-based data protection management system (DSMS)

How we work

Four steps to your goal.

  1. Step 01

    Initial conversation

    Free, no obligation. We listen, clarify requirements from your sector and data intensity, and name effort and fee, usually within 24 hours.

  2. Step 02

    Appointment

    Written appointment under Art. 37 GDPR, followed by notification to the competent supervisory authority.

  3. Step 03

    Assessment

    Records of processing activities, DPAs, technical and organisational measures, we record what already exists.

  4. Step 04

    Ongoing support

    Authority interface, employee training, data breach response, data protection impact assessments. Predictable monthly fee from EUR 249 plus VAT.

Your Invest

Three packages, predictable per month.

A monthly hour retainer tailored to your needs, instead of an hourly lottery. All packages cover the same scope and differ only in the hour allowance, the retainer and the cost of the initial assessment.

Package

Kompakt

For start-ups & small companies with a manageable data structure

from € 249 / month

excl. VAT

Hour allowance 2 hrs / month
RetainerA retainer is a fixed, recurring flat fee for an agreed hour allowance, predictable instead of billed item by item. The period states over which term the allowance runs. Monthly
Extra hour €200
Assessment fee €500
Request Kompakt →
Most popular

Package

Standard

For mid-market companies with a regular data structure.

from € 499 / month

excl. VAT

Hour allowance 4 hrs / month
RetainerA retainer is a fixed, recurring flat fee for an agreed hour allowance, predictable instead of billed item by item. The period states over which term the allowance runs. Quarterly
Extra hour €200
Assessment fee €1,000
Request Standard →

Package

Plus

For large enterprises with a complex data structure.

from € 999 / month

excl. VAT

Hour allowance 8 hrs / month
RetainerA retainer is a fixed, recurring flat fee for an agreed hour allowance, predictable instead of billed item by item. The period states over which term the allowance runs. Half-yearly
Extra hour €200
Assessment fee €1,500
Request Plus →

Scope of services in our packages

Included in each of the three packages, regardless of hour allowance and retainer.

Base scope

  • Appointment as external Data Protection Officer and registration with the competent authorities (Art. 37 GDPR)
  • Assessment of the current state and gap analysis (baseline review)
  • Records of processing activities (Art. 30 GDPR)
  • Drafting of privacy policies (Art. 13 GDPR, Art. 14 GDPR)
  • Review of service providers and data processing agreements (Art. 28 GDPR)
  • Use of our cloud-based data protection management system (DSMS)
  • Personal point of contact

Optional add-ons

  • Internal policies for employees
  • Staff and management training
  • Use of our cloud-based whistleblower platform (HinSchG)

Custom

When none of the packages fit: price, extra hourly rate, assessment fee and hour allowance are all flexible (half-year retainer), services based on your individual needs.

Request a custom quote →

All prices plus statutory VAT. Additional hours beyond the monthly retainer allowance are billed per quarter hour at the stated hourly rate. The packages have no minimum term and can be cancelled with three months' notice to the end of a month (section 7 of the terms).

Duty & role

When a Data Protection Officer is mandatory.

Whether your company must appoint a Data Protection Officer (DPO) does not depend on headcount alone. We clarify the obligation, take on the role externally and become your interface with the supervisory authority. Clients in Frankfurt am Main and the Rhine-Main region we look after in person; the ongoing work runs independently of location.

The appointment duty applies in these cases

  • At least 20 people constantly involved in automated processing (§ 38 BDSG)
  • Core activity involves large-scale, regular monitoring of individuals (Art. 37 GDPR)
  • Large-scale processing of special categories of data (e.g. health data)
  • Activities that require a data protection impact assessment

Internal or external appointment?

An external DPO brings expertise without a conflict of interest, is not subject to the special protection against dismissal of an internal appointee, and is covered by professional liability insurance. You save setup, training and cover costs and tie up no internal resources.

Duties of the DPO (Art. 39 GDPR)

  • Informing and advising management and staff
  • Monitoring compliance with the GDPR and the BDSG
  • Advising on and supporting data protection impact assessments
  • Cooperating with and acting as contact point for the supervisory authority

Liability and fines

Failing to appoint a DPO where one is required risks fines of up to €10m or 2% of worldwide annual turnover (Art. 83(4) GDPR). Breaches of the principles or of data subject rights can cost up to €20m or 4% (Art. 83(5)). Responsibility remains with management. An appointed DPO reduces this risk and creates demonstrable structures.

More services

What else we cover.

From the blog

Further reading on the topic.

Need advice on data protection?

Give us a call. The first conversation is free and without obligation.

Call directly +49 (0)69 27 13 57 20-0
Request a callback →

Frequent questions

What companies want to know about an external Data Protection Officer.

From what company size must I appoint a DPO?
Once at least 20 people in your company are constantly involved in the automated processing of personal data, appointment is required by law (§ 38 BDSG). The obligation can also exist regardless of headcount, e.g. for large-scale processing of special categories of data (such as health data, genetic data, religious or philosophical beliefs) or profiling.
What does an external Data Protection Officer cost?
From EUR 249 per month plus VAT in the "Kompakt" package for companies up to 20 employees, scaling up by company size and data structure to the "Plus" package. We confirm the exact flat fee in the initial conversation, with no hidden hourly rates.
How long does the appointment take?
Usually 1 to 2 weeks from the initial conversation to the formal appointment under Art. 37 GDPR. In parallel we set up the data protection management system and register the appointment with the competent supervisory authority.
What happens in a data breach?
We handle data breaches for our clients with raised priority. Notification to the supervisory authority under Art. 33 GDPR is mandatory within 72 hours; we handle the assessment, notification and communication, document the incident and develop immediate and follow-up measures.
What fines and penalties are possible?
Breaches of the processing principles, the legal bases, data subject rights or transfers to a third country (Art. 83(5) GDPR): up to €20 million or 4 % of worldwide annual turnover. Breaches of controller and processor obligations, such as the record of processing activities, security of processing, breach notification or appointing a data protection officer (Art. 83(4) GDPR): up to €10 million or 2 % of worldwide annual turnover. Whichever amount is higher applies. Alongside a fine, a supervisory authority may order, restrict or prohibit the processing; section 42 BDSG additionally makes certain intentional acts a criminal offence, punishable by up to three years imprisonment or a fine.