Data Protection Officers and the new BDSG - still mandatory!

With the introduction of the GDPR, the topic of data protection officers has suddenly become interesting. This is true for external parties as well as for those responsible within the company or for the Data Protection Officer (DPO) himself. The once boring and meticulous role seemed to become more attractive. For consultancies, new fields of activity suddenly emerged. However, the issue is not new.

The deviations from the requirements of the old Federal Data Protection Act (BDSG) are rather manageable. You can read more about the duties of the data protection officer here, and the differences to the old law are explained here. The question of whether to appoint an internal or external DPO is often the subject of intense debate. On the one hand, the costs for external DPOs are undoubtedly higher, at least if the necessary qualification costs are not taken into account. On the other hand, dependencies arise because an internal DPO enjoys job protection similar to that of a works council member.

Costs and dependencies need to be carefully considered. The decision may depend on how critical the handling of personal data is perceived within the company. The more seriously the decision-maker takes this issue, the more likely it is that he will opt for experience and competence.