DSB costs 2026: What a data protection officer really costs internally and externally

According to Section 38 BDSG and Art. 37 GDPR, a data protection officer must be appointed as soon as at least 20 people are constantly involved in the automated processing of personal data or certain risky processing takes place. The obligation is clear, the question of costs is rare. Board members want to know whether an annual fee of 4,800 euros is realistic, whether an internal DSB is cheaper and which items are regularly missing from the comparison offers.

This guide breaks down the DSB costs into a full cost basis, compares internal and external, names the typical fee models, the 2026 ranges and the hidden items that are underestimated in 9 out of 10 offers. At the end there is a reliable decision matrix and a reference to the CIVAC model as a third option. Turn reading into an assignment.

Section 38 (1) BDSG requires an appointment to be made as soon as at least 20 people are generally constantly involved in the automated processing of personal data. Art. 37 Para. 1 GDPR supplements an obligation for core activities with extensive regular monitoring or extensive processing of sensitive data according to Art. 9 or criminal data according to Art. 10 GDPR.

The 20-person threshold seems lower than it is. Interns, working students, marketing and sales employees with CRM access count. Anyone who ignores this will quickly run into an unchecked ordering obligation and thus run the risk of a fine under Article 83 Paragraph 4 Letter a of the GDPR, which is sanctioned with up to 10 million euros or two percent of group sales.

Even below the threshold, a voluntary appointment makes sense as soon as the risks are concrete. These include a medical practice with twelve employees, an online retailer with profile creation or a SaaS provider with cross-border transfers. In all of these cases, a documented risk assessment is mandatory; voluntary appointment often follows from this.

The duty cannot be delegated to a managing director or an IT manager. Article 38 (6) GDPR prohibits conflicts of interest, and the EDPS clarified in 2019 that management functions are considered to conflict with data processing responsibilities. This significantly limits internal personnel options in many companies and increases the attractiveness of external models.

The CIVAC role of data protection officer takes on both the mandatory analysis and the subsequent appointment with an appointment certificate, notification to the supervisory authority and reporting line to the management. The appointment certificate, signed, filed, verifiable.

Anyone who misjudges the obligation risks not only fines, but also claims for damages in accordance with Art. 82 GDPR and, in exceptional cases, criminal consequences in accordance with Section 42 BDSG. The question of costs begins with a thorough mandatory audit, not with offers of fees.

The full cost calculation for an internal DSB includes gross salary, employer contributions to social security, workplace, IT, further training, travel costs, replacement and tooling. An experienced internal DPO in a medium-sized company will have a gross salary of 70,000 to 95,000 euros in 2026, with full costs reaching 95,000 to 130,000 euros annually, depending on location and group affiliation.

In smaller organisations, the DPO role is often assigned on a part-time basis, for example to the legal department or quality management. This apparently reduces personnel costs, but increases the risk of conflict according to Art. 38 Para. 6 GDPR and reduces the time available for the role to 10 to 20 percent of a full-time position. In relation to the full costs, you quickly end up with 18,000 to 28,000 euros per year.

Additional training is required. The DSB must continually prove his qualifications; common certifications such as TÜV or Udo Helmbrecht Academy initially cost 2,500 to 4,000 euros, plus 1,500 to 2,500 euros per year for updates and conferences. These items are missing from most internal calculations and only become visible during a supervisory audit.

The replacement is mandatory as soon as the DPO is absent for a longer period of time. A named deputy with their own training costs around 30 to 50 percent of the main role, often distributed among colleagues. Anyone who does not appoint a representative risks gaps in the reporting path in the event of vacation or illness and thus again risks fines according to Art. 33 GDPR.

Tooling and documentation cost additionally. Simple solutions such as tables are not audit-proof; commercial tools cost between 2,400 and 12,000 euros per year, plus the expense of setting up and maintaining them. Overall, the full costs of an internal solution in medium-sized businesses are rarely less than 35,000 euros per year, and are often significantly higher.

A rarely mentioned item is the liability risk. The DPO himself is not personally liable according to Art. 38 Para. 3 GDPR, but the company is. Financial loss liability insurance for this position costs 1,200 to 3,500 euros per year and is often forgotten when compared to external models.

The external DPO is usually paid a flat rate or hourly basis. Flat-rate models dominate in the SME segment and in 2026 will range from 400 to 1,200 euros per month for companies with up to 50 employees, 1,200 to 2,500 euros per month for companies with up to 250 employees and 2,500 to 6,000 euros per month for larger medium-sized companies with a higher risk profile.

Hourly models range between 140 and 280 euros net per hour, depending on specialization and region. They are suitable for project phases, audit preparations or specific DPIA projects in accordance with Art. 35 GDPR. For ongoing DSB orders, they are usually more expensive than flat rates because regular activities occur continuously and are difficult to cap.

The ranges vary greatly with the risk profile. A small advertising agency without profiling will rarely pay more than 480 euros per month in 2026. An e-commerce provider with tracking, customer data and EU-wide transfers pays 1,200 to 2,000 euros. A clinic operator, financial service provider or telecommunications provider quickly reaches 4,000 to 8,000 euros per month.

What is included in the flat rate varies considerably. The standard is a directory in accordance with Article 30, training of employees, initial contact with the supervisory authority, telephone and email support, and one audit per year. What is often not included: DPIAs, incident handling, international transfers, data processing agreements and on-site appointments. These items are billed separately and easily increase the costs by 30 percent.

The CIVAC Officer-as-a-Service variant bundles these items in a transparent flat rate with a defined service catalogue, a documented SLA of two working days and no subsequent hourly rates for regular activities. Others run compliance like a filing cabinet. We run it like software.

Anyone comparing offers should explicitly compare the service catalogue, response time, on-site days and incident processing. A flat rate of 480 euros without incident processing is not cheaper than a flat rate of 980 euros with unlimited incident processing, but more expensive as soon as the first incident occurs.

The most common mistake is underestimating incident effort. A single data breach according to Art. 33 GDPR costs external service providers 2,500 to 8,000 euros in special compensation in individual cases, internally corresponding to employee time. If you have three incidents per year, you can easily add 15,000 euros to the nominally cheap flat rate.

The second block is the DPIA according to Art. 35 GDPR. As soon as new procedures are introduced, such as CRM changes, the use of AI or cloud migration, an impact assessment is required. External DPOs calculate 1,500 to 6,000 euros per DPIA, internally the effort is 40 to 120 hours. In a medium-sized company with strong digitalization, 3 to 6 DPIAs are created per year.

The third block is order processing contracts. Every new SaaS tool requires a check and an AVV in accordance with Art. 28 GDPR. External flat rates cover 5 to 10 AVV per year, anything above that costs extra. In fast-growing companies, 30 to 80 AVV are incurred per year; the difference can exceed 5,000 to 15,000 euros.

The fourth block is training. Art. 39 Paragraph 1 Letter b GDPR requires employees to be sensitized and trained. An annual online training course for 200 employees costs 1,800 to 6,000 euros, depending on the provider, plus tracking, reminder emails and success monitoring. These items are rarely included in the flat rate.

The fifth block is supervisory authority communication. Inquiries, hearings and on-site inspections cost an additional 2,500 to 12,000 euros per process from external providers. CIVAC bundles this communication in the officer flat rate because a clearly documented reporting line reduces the response time to just a few hours. The auditor calls, the evidence is ready.

The sixth block is versioning. Anyone who does not have an audit-proof file will pay twice in the event of an audit, once for the restoration of the documents and once for the declaration to the auditor. CIVAC provides 490 ready-to-use audit templates with built-in versioning, which reduces this effort to zero.

Three models will be available in 2026. The internal model with its own office is suitable for companies with 500 or more employees with their own legal department and high processing volume. Full costs are 95,000 to 160,000 euros per year, the advantage is deep integration, the disadvantage is representation, further training and conflict risks according to Art. 38 Para. 6 GDPR.

The classic external model is suitable for SMEs with manageable processing volumes. Flat rates of 400 to 2,500 euros per month are realistic, plus 25 to 40 percent for hidden items. The advantage is the independence, the disadvantage is the often missing tool integration and the non-standardised documentation.

The Officer-as-a-Service model, as offered by CIVAC, combines both worlds. The appointed DPO works in the same workspace in which you orchestrate your internal representatives. Licence the workspace for your internal representatives, or have our representatives order it. Both variants share templates, reporting line, incident register and EU data residency.

The cost structure is transparent. Officer-as-a-Service costs between 1,500 and 4,500 euros per month for medium-sized companies, including tooling, training, AVV testing in a defined volume, incident processing and communication with supervisory authorities. This is usually 30 to 50 percent cheaper than the full cost calculation of an internal position with equivalent maturity.

If you strictly compare the model with classic external flat rates, you will see the surcharge. If you include all the hidden items, you will see the savings. The decision is therefore rarely based on the list price, but rather on the level of maturity of one's own documentation and the importance that management attaches to the reporting line.

A reliable basis for comparison requires the listing of all items, not just the flat rate. CIVAC provides a comparison matrix in the workspace that compares the three models based on 18 parameters, from response time to training frequency to versioning. Audit-proof, documented, § 38 BDSG-proof.

Health care is the biggest driver of costs. Clinic operators, medical practices and care facilities process sensitive data in accordance with Art. 9 GDPR and are also subject to the Hospital Future Act, the Professional Code and the SGB. External DSB flat rates rarely start at less than 1,500 euros per month; a hospital network quickly reaches 6,000 to 10,000 euros.

Financial service providers have a comparable surcharge, driven by DORA, BAIT, KAIT and MaRisk. This is where close interaction with the information security officer comes into play because many duties have to be fulfilled in parallel. Anyone who manages the DSB and the information security officer in one workspace saves 20 to 30 percent of coordination effort.

E-commerce is medium-priced, but high-volume. AVV volumes, cookie banners, tracking, profiling, international transfers according to Art. 44 ff. GDPR and the ongoing observation of ECJ rulings drive the DSB effort. A flat rate of 800 to 1,800 euros per month is common here, with volume clauses for AVV tests.

Industry and mechanical engineering are often cheaper because the processing volume per employee is lower. Flat rates range from 500 to 1,200 euros per month; the driving factor here is more the joint venture or group context with cross-border data flows and HR data processing via group systems.

Public bodies and authorities have a special status according to Section 5 Paragraph 1 BDSG. Here the order is mandatory regardless of the number of employees. External mandates are permitted, the market is price-driven, and flat rates are often in the lower third. The requirements for training, directories and transparency are higher than in the private sector.

If you classify your own industry realistically, you avoid both mistakes: expensive oversizing and risky undersizing. CIVAC offers a free initial classification in which the risk profile is assessed based on 12 parameters. This results in a reliable estimate of the DSB costs for the next 12 months.

The contract with an external DPO should contain at least five components: appointment certificate in accordance with Art. 37 ff. GDPR, service description with a clear quantity structure, SLA with response time, confidentiality and confidentiality obligation in accordance with Section 38 Paragraph 2 BDSG as well as a substitute provision for illness and vacation.

The term is usually 24 or 36 months with notice periods of three to six months. Shorter terms increase the flat rate noticeably because the training and recording of the processing directory are an initial expense that is only amortized over the term. Attention with automatic extension: § 309 No. 9 BGB sets limits.

Liability must be regulated carefully. According to Article 38 Para. 3 GDPR, the DPO itself is not liable for its advisory work, but the provider is liable for poor performance. Usual liability limits are an annual flat rate or 250,000 euros, whichever is higher. Lower caps are a warning sign.

Data residency is often overlooked. If the external DPO uses cloud tools that are hosted outside the EU, a third country transfer occurs in accordance with Art. 44 ff. GDPR. CIVAC sets EU data residency as standard, hosts all incident and directory data within the EU and stipulates this contractually.

The consequences of termination must be regulated. Anyone who switches must receive the processing directory, audit reports, DPIA documents and training certificates in full, ideally in a standardised export format. A missing export clause can lead to significant frictional losses and additional costs.

It is worth checking your references before signing. Two to three clients in a comparable industry are enough to validate the statements on the service catalogue. CIVAC provides references from the respective industry, provided the client approval is available. Deadline expires as soon as we become aware of it.

If you have fewer than 50 employees with a manageable processing volume, the classic external model is usually the most cost-effective solution. Flat rates of between 400 and 800 euros per month cover standard requirements, provided there is no sensitive data processing or cross-border transfers.

Between 50 and 250 employees, a precise comparison is worthwhile. Classic external flat rates are 1,000 to 2,500 euros per month, without incident and DPIA reserves. Officer-as-a-Service is in the same range, but covers the entire range of services. The effective total costs are often 20 to 35 percent lower than the classic model.

Between 250 and 1,000 employees, the comparison begins with an internal position. Pure personnel costs are 95,000 euros, full costs are 130,000 euros. Officer-as-a-Service achieves the same level of maturity at an annual flat rate of 30,000 to 55,000 euros, without replacement problems and with a guaranteed SLA of two working days.

A hybrid solution makes sense for over 1,000 employees. An internal position for deep integration, an external DPO as sparring and representative, a common workspace for templates, incident registers and reporting lines. CIVAC enables this hybrid form through the same platform for internal and external representatives.

Risky industries are moving the thresholds lower. A medical practice with 20 employees has a higher need for DSB than a mechanical engineer with 80. An online platform with profiling has a higher need than a local tradesman. The thresholds are therefore guidelines, not absolute limits.

The most important lever is not the price per month, but rather the avoidance of fines and reputational damage. A single fine according to Art. 83 GDPR in the five-figure range costs more than ten years of external DSB flat rate. This asymmetry should appear in every decision template.

CIVAC is a compliance platform and officer-as-a-service. You can licence the workspace for your internal representatives, or you can have our representatives order it. Both variants share templates, incident register, reporting line and EU data residency. This makes the comparison between in-house work and outsourcing operational, not theoretical.

The Officer-as-a-Service flat rate includes 490 audit templates, AVV checks in a defined volume, DPIA support in a defined volume, incident processing in accordance with Art. 33 GDPR, supervisory authority communication, employee training and an SLA of two working days for the initial response. There are no hidden items in the contract, the quantity structure is transparent.

The Workspace licence for internal representatives is aimed at companies that employ their own DPO but want to place the documentation and reporting line on a modern, audit-proof foundation. The appointment certificate, signed, filed, verifiable. The licence costs are between 6,000 and 24,000 euros per year, depending on the number of users and module selection.

The comparison with classic external DSB models is documented on the CIVAC FAQ page, including sample calculations for 50, 200, 500 and 1,500 employees. If you want an individual calculation, you will receive it within two working days after a 30-minute initial consultation.

If you would like to check today whether your current DSB model is economically and legally viable, please contact us. Turn reading into a mandate.: info@civac.de or the contact form on civac.de. You will receive an initial assessment including a cost model and information about acute gaps.

Anyone who is currently facing a supervisory audit should choose the express route. The appointed DPO takes over communication with the authorities, the workspace provides the templates, and the reporting line to management is in place from day one. The auditor calls, the evidence is ready.