Data Protection Officer appointment threshold

Where this applies

This record is scoped to Germany. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.

Instrument

Bundesdatenschutzgesetz (BDSG), §38

Who it binds

Private-sector organisations that generally employ at least 20 people continuously engaged in the automated processing of personal data

What it requires

BDSG §38: an organisation must appoint a Data Protection Officer "soweit sie in der Regel mindestens 20 Personen ständig mit der automatisierten Verarbeitung personenbezogener Daten beschäftigen." This 20-person threshold is a German-specific addition on top of GDPR, which does not itself set a headcount threshold for this duty. Supervision is split under BDSG §40: the 16 Länder data-protection authorities cover the private sector, while the Federal Commissioner for Data Protection and Freedom of Information (BfDI) covers federal public bodies, social security carriers, and telecom/postal providers.

Related records and requirements

• Data Protection Officer appointment (Singapore) — Singapore's PDPA s.11(3) requires designating one or more individuals responsible for the organisation's compliance — a distinct duty from any separate PDPC registration channel.
• Act Respecting the Protection of Personal Information in the Private Sector (Québec) (Canada) — Québec's law requires designating a person in charge of the protection of personal information — by default the business's highest authority, delegable in writing.