DACH data protection officer: One order, three legal areas, one proof

The revised Data Protection Act (revDSG) has been in force in Switzerland since September 1, 2023, which brings the requirements for those responsible closer to the GDPR without making them the same. In Austria, the GDPR applies in parallel with the Data Protection Act (DSG as amended), and in Germany with the BDSG. Anyone who appoints a data protection officer for the DACH region is effectively working in three legal areas with three supervisory authorities: BfDI and state supervisory authorities in Germany, DSB in Vienna and EDÖB in Bern. The operational question is rarely whether, but rather how, the order is structured cleanly, without a single gap making the entire group solution formally vulnerable.

This article addresses group structures with subsidiaries in several DACH countries and explains when a central order is viable, when local representatives are mandatory and which documentation is sufficient for the auditor. CIVAC is a compliance platform and officer-as-a-service that maps these structures in practice, from proof of order to the reporting line to the reporting chain. The article works with specific paragraphs, deadlines and interfaces so that the reading becomes a reliable decision. At the end you will receive a clear checklist of which documents, deadlines and languages ​​you have to expect operationally.

Art. 37 Para. 2 GDPR expressly allows a group of companies to appoint a common data protection officer, provided that he or she can be easily reached from each branch. This regulation applies directly in Germany and Austria. As a third country, Switzerland applies its own law: Art. 10 revDSG recognises the data protection advisor as a voluntary but factually expected function in private law processing with a high risk. In principle, a group order via DACH is possible, but it must fulfil three layers, which are rarely clearly separated in practice.

First layer: accessibility. The DPO function must be documented in the national language, with local telephone number and address, for each data subject. Second layer: supervisory communication. Inquiries from Vienna, Berlin or Bern end up with different authorities with different deadlines and different procedural rules. Third layer: verification. The appointment certificate, signed, filed, verifiable, in a language that the respective supervisory authority accepts. Accessibility does not necessarily have to be physical in the respective country, a reachable telephone number and a staffed email inbox are sufficient if they provide answers within 48 hours.

CIVAC maps these three layers in the workspace in a structured manner, with appointment certificates for each company and a consolidated reporting line to the external data protection officer. If you don't separate the layers, you risk that a single, incomplete subsidiary will make the entire group order formally vulnerable. Licence the workspace for your internal representatives, or have our representatives order it. The decision rarely depends on costs, but rather on the question of whether the professional profile already exists internally or needs to be developed first. A hybrid variant, in which the function is filled internally but secured by external audit templates and an external deputy, has proven to be a reliable compromise in medium-sized companies with between 250 and 1,500 employees.

On paper, the three regimes appear similar, but in day-to-day business there are five differences that drive the effort. Firstly, the reporting obligation: Art. 33 GDPR requires a report to the supervisory authority within 72 hours of becoming aware of it, Art. 24 revDSG requires a report to the FDPIC as quickly as possible in the event of a high risk, without a rigid deadline. The clock starts on awareness. Secondly, the sanctions: fines of up to 20 million euros according to the GDPR, fines of up to 250,000 CHF according to revDSG, but personally against the responsible natural person, not against the legal entity of the company.

Thirdly, the list of processing activities: Art. 30 GDPR and Art. 12 revDSG are similar in content, but Switzerland allows exceptions for SMEs with fewer than 250 employees without high risk. Fourth, data transfer: Swiss data to other EU countries is considered cross-border disclosure according to Art. 16 revDSG, with its own list of safe states, maintained by the Federal Council. Fifth, order processing: Art. 28 GDPR and Art. 9 revDSG differ in the level of detail of the mandatory clauses. For Swiss processors, additional declarations of commitment are typically designed as an appendix to the existing GDPR-AVV.

Anyone who uses a DACH-DPO needs documented instructions for action for each of these five fields. The auditor calls, the evidence is ready. CIVAC's 490 audit templates cover each of the five fields with two to three different templates, depending on group size and risk profile. The templates are available in the respective national language and in the English corporate version, with audit-proof versioning. This means that the effort per country remains manageable without losing the group view.

The Austrian Data Protection Authority (DSB) is based in Vienna and keeps the register of registered data protection officers. Section 5 DSG refers to the GDPR, but supplemented by national procedural rules. A DSB order must be displayed to the authority online via the company service portal (USP), with name, contact details and accessibility. For group solutions, the central DSB function is entered, but each Austrian subsidiary is also provided with its own notification. This double structure is often overlooked and is one of the most common formal findings in supervisory audits.

In practical terms, this means: A DPO function based in Munich that is responsible for the Austrian subsidiary must be registered in Vienna, with a German address and accessibility regulations in German. The DSB Vienna accepts this, but regularly asks if you can only be reached via a foreign hotline. A local response channel, such as an Austrian PO box or a summonsable address via a Viennese representative in accordance with Art. 27 GDPR, closes the gap. For corporations with more than three Austrian subsidiaries, it is recommended to have a central postal address in Vienna to which all supervisory correspondence is addressed.

CIVAC structures this double display as a standard process in the workspace, including a template for USP entry and the obligation to report on incidents. Licence the workspace for your internal representatives or have our representatives order it. The notification to the DSB Vienna is stored in the system with a confirmation number and date so that the proof can be found in seconds during a supervisory check. The appointment certificate, signed, filed, verifiable. This documentation chain is the crucial difference between a formally clean and a vulnerable corporate order. In the past two years, the DSB Vienna has emphasised several times that formally incomplete reports can be viewed as a violation of the obligation to cooperate, with the potential for a fine of their own.

The revised data protection law distinguishes between the GDPR logic of a data protection officer and the Swiss concept of the data protection advisor according to Art. 10 revDSG. Those responsible under private law are not obliged to appoint one, but gain the relief that a data protection impact assessment does not necessarily have to be submitted to the FDPIC in the event of a high risk, provided a data protection advisor has been consulted. Federal bodies are subject to stricter rules according to Art. 25 VDSG. This dividing line is often drawn incorrectly in corporate structures, with the result that an actually facilitating function is not used.

Operationally, this means: A DACH DPO function can take on the role of data protection advisor in Switzerland, provided that it can demonstrate sufficient expertise and independence and the FDPIC can reach the contact. The FDPIC in Bern does not require prior notification of the person, but does require proof of consultation in DPIA-relevant processes. Swiss subsidiaries must also check whether they need a representative in Switzerland in accordance with Art. 14 revDSG if processing operations are offered from abroad. The representative is not identical to the data protection advisor, but both functions can be held by the same natural or legal person.

CIVAC maps both roles in the workspace, with a separate reporting line for Swiss matters and an audit template for the DPIA consultation. The reporting line runs directly to management, not through local IT managers. The DPIA consultation is filed as a signed document between the data protection advisor and the person responsible, with the version status and proof of the statement made. Others run compliance like a filing cabinet. We run it like software. The platform reminds you of follow-up consultations, documents risk decisions made and makes them available for an FDPIC request in under 60 seconds.

In the worst case, a data breach in a DACH group affects all three supervisory authorities at the same time. Art. 33 GDPR sets 72 hours from knowledge for Germany and Austria, with different reporting portals: federal state authorities in Germany, DSB Vienna for Austria. Art. 24 revDSG requires a report to the FDPIC as soon as possible if there is likely to be a high risk to the personality of the person concerned. The threshold is therefore higher than under the GDPR, but the deadline is indefinite. Three parallel reports are not an exception, but rather the rule for cross-border incidents.

CIVAC's DSB workspace maps a uniform incident path with three branches. The date of receipt, risk analysis and those affected are recorded once and the three reporting forms are filled out automatically. The clock starts on awareness. A follow-up message in accordance with Art. 33 Para. 4 GDPR in the event of incomplete information will be noted in the workspace. For Switzerland, the system generates an accompanying note explaining why the report was made or intentionally not made, with reference to the risk assessment. This note is the decisive audit evidence for the FDPIC.

Without this note, the decision against a report remains open to argument. A later supervisory audit can then no longer understand the risk assessment, and the failure is viewed as a supervisory violation. Linking to the NIS-2 reporting path is possible if the incident also triggers a cybersecurity report, such as ransomware with data exfiltration. The auditor calls, the evidence is ready. The parallel provision of the three reporting paths is the central added value of a consolidated DACH DPO list. Experience has shown that manual processing of parallel reports takes four to six hours without a platform, and under an hour with a platform.

Art. 38 Para. 3 GDPR requires that the data protection officer does not receive any instructions and reports directly to the highest management level. § 6 DSG Austria and Art. 10 revDSG Switzerland formulate similar, although not identical, requirements. In a DACH group, this practically means: The DSB reports to the group board, not to the management of an individual subsidiary, and certainly not to the IT manager. This reporting line is often linguistically abbreviated in appointment certificates, which becomes a question of interpretation in the event of an audit.

A clean list documents three points. Firstly, the direct reporting line to the highest management level, by name and by proxy. Secondly, the prohibition of instructions on technical data protection issues, including the obligation to record dissenting opinions. Thirdly, protection against dismissal in accordance with Article 38 Paragraph 3 Sentence 2 GDPR, which is additionally protected in Germany by Section 6 Paragraph 4 BDSG. In Austria and Switzerland, this special legal anchoring is missing, which is why contractual regulations are even more important. The appointment certificate should provide for a separate clause on protection against dismissal for each DSB area, with reference to the national legal situation.

CIVAC provides an appointment certificate template for each country that covers all three points and can be accessed in the respective country version via the FAQ overview. The templates were coordinated with German, Austrian and Swiss data protection lawyers and are updated centrally if the law changes. The reporting line is stored in the workspace as an organisational chart; every change creates a versioned file. Others run compliance like a filing cabinet. We run it like software. This is not just a question of style, but the basis for a robust audit in each of the three jurisdictions.

An often underestimated hurdle is the procedural language. The DSB Vienna conducts procedures in German, the EDÖB in German, French or Italian for each cantonal jurisdiction, and the German state supervisory authorities exclusively in German. A DACH DPO must therefore be able to respond in writing in the relevant languages, or appoint a local representative to take on this task. Art. 27 GDPR regulates the representative for those responsible who are not established in the EU, Art. 14 revDSG regulates the representative in Switzerland for the opposite constellations.

The clean variant: A DACH DPO with a German native language, supplemented by a Swiss data protection advisor for Romansh-speaking areas and an Austrian representative with a summonsable address. This three-way structure costs less than three separate DPO functions and satisfies all three oversight requirements. Anyone who relies on a pure DACH DSB without local representatives risks procedural delays, which can be seen as aggravating circumstances in the fine proceedings. The FDPIC in particular has explicitly criticized the lack of local accessibility in recent decisions.

CIVAC has a template available for every constellation, from a simple display to a three-tier representative structure. The audit templates are available in the respective procedural language and are updated centrally if the law changes. In practice, this saves the days that would otherwise be lost due to translations between the incident and the report. Corporations that work with French-speaking cantons such as Geneva or Vaud should also check whether their DPIA templates are available in two languages. For larger data flows into Romansh-speaking areas, continuous French file management is recommended, with a German corporate version as an accompanying document. The FDPIC entries can be made in both languages; a translation is only mandatory in proceedings before the Federal Administrative Court.

Classic consulting offers for a DACH DSB appointment bill three separate mandates: Germany, Austria, Switzerland. Hourly rates of 180 to 250 euros per jurisdiction are standard market rates, with minimum quotas of 8 to 16 hours per month per country. Extrapolated, the annual costs are between 60,000 and 110,000 euros, without incident processing and without training. The majority of the effort does not arise from consulting, but rather from repeating the same issues in three files and manually consolidating the reports for the corporate board.

A consolidated officer-as-a-service approach reduces this repetition. CIVAC SLA: 2 working days instead of 2 to 6 weeks classic, with 490 ready-to-use audit templates that are pre-designed for GDPR, DSG and revDSG. The reporting line runs to the top of the group, the appointment certificates are generated for each country, and the reporting chain is consolidated. Overall, the administrative effort is reduced by the factor that repetition would otherwise cause. Training for local employees takes place via a central learning system, with country-specific mandatory modules on GDPR, DSG and revDSG.

An exact calculation depends on the number of subsidiaries and the volume of incidents. One indication: Groups with five to twelve DACH subsidiaries typically earn less than 50,000 euros annually in the consolidated model, with fully documented evidence. The savings are not in cheaper hourly rates, but in avoiding redundant file management. For very small subsidiaries with less than ten employees, the workspace licence for internal officers can be worthwhile; for medium-sized and larger subsidiaries, the external officer-as-a-service can be worthwhile. Both models use the same platform with identical audit templates and EU data residency. This data residency is particularly relevant for Swiss clients because it avoids additional disclosure in third countries and simplifies the assessment according to Art. 16 revDSG.

A DACH DSB set-up does not succeed through three parallel mandates, but rather through a consolidated structure with locally visible accessibility. The legal basis is Art. 37 Para. 2 GDPR in conjunction with the national specifics in Section 5 DSG Austria and Art. 10 revDSG Switzerland. The operational basis is a platform that maintains appointment certificates, reporting paths and reporting lines in a single file structure. The commercial basis is to avoid redundant advice across three jurisdictions without compromising local accessibility.

CIVAC is a compliance platform and officer-as-a-service with 25 officer roles, 490 audit templates and EU data residency. Licence the workspace for your internal representatives, or have our representatives order it, in any DACH jurisdiction. The setup takes two working days instead of two to six weeks. We deliver a complete initial set with an appointment certificate, reporting line, reporting paths and an initial inventory of processing activities.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. We respond to inquiries within four hours on weekdays with a concrete proposal for the list, including information on the appointment certificate, reporting line and reporting chain. In a preliminary discussion, we will clarify whether your internal team needs a workspace licence or our order. This is followed by a set-up appointment lasting around 90 minutes, during which the appointment certificates for each country are signed and the first reporting paths are tested. The appointment certificate, signed, filed, verifiable. The entire onboarding process is kept as a versioned file in the workspace so that a later supervisory audit can completely reconstruct when which order was placed. Anyone planning a DACH setup should also check whether other representative roles such as information security, money laundering or whistleblower protection can be managed in the same platform in order to consolidate the reporting lines to the corporate board and save audit effort across all representative roles.