External data protection officer for tax advisors: duties, appointment, evidence

According to Section 38 Paragraph 1 BDSG, tax firms must appoint a data protection officer as soon as at least 20 people are generally constantly involved in the automated processing of personal data. In addition, there is the client-side expectation: those who are responsible for payroll, accounting and annual financial statements process health data, social security numbers and account movements, i.e. categories with increased protection requirements according to Art. 9 GDPR. Since 2024, the supervisory authorities have been increasingly examining appointments in medium-sized law firms because the interface between client confidentiality and order processing is particularly vulnerable there. Activity reports from the LfDI Baden-Württemberg document increasing numbers of complaints from clients.

The double obligation of confidentiality according to Section 57 StBerG and data protection makes the role in tax law firms demanding. This article explains when the obligation to order is triggered, what specific tasks an external data protection officer takes on, how the appointment certificate and the reporting line to management are documented and what effort you should realistically plan for in the first 90 days. You will also receive an overview of the typical procedural lists of a tax law firm, an evaluation of standard market remuneration models, instructions for changing the current DPO and a checklist for selecting an external representative. At the end of the article we show how to complete the order via CIVAC within 2 working days, including reporting to the supervisory authority, initial inventory and linking to the 490 prepared audit templates in the CIVAC Workspace.

The threshold according to Section 38 Paragraph 1 BDSG is 20 people who are constantly involved in automated data processing. What matters is the number of people, not the full-time equivalents. Anyone who works with DATEV, wage programs or law firm CRM counts. Interns, working students and freelancers must be included as soon as they regularly work on the relevant systems. Part-time employees also count if they have their own account and actually access client data.

Regardless of the threshold, the obligation to order according to Article 37 Paragraph 1 Letters b and c GDPR always applies when core activities require extensive, systematic monitoring of those affected or the extensive processing of special categories of data. This threshold is regularly reached in medium-sized law firms when it comes to payroll accounting with illness data, when processing inheritance cases with health certificates or when managing clients with creditworthiness information. The Data Protection Conference made it clear in its brief paper No. 12 that payroll accounting with health data is considered extensive processing as soon as more than 50 payroll accounts are maintained.

The supervisory authorities of the federal states, such as the LfDI Baden-Württemberg, check the order as part of event-related controls. If the DSB is missing or the appointment certificate is not presented, there is a risk of a fine according to Art. 83 Para. 4 GDPR of up to 10 million euros or 2% of the global annual turnover. In practice, the fines for law firms are in the five-figure range, supplemented by orders to remedy deficiencies. The role of the external data protection officer completely covers this requirement with an appointment certificate, a documented catalogue of tasks and a reported contact address. For security purposes, we recommend a written threshold analysis, which is updated annually, so that personnel changes and new procedures do not fall under the order requirement unnoticed.

Tax advisors are subject to the obligation of confidentiality in accordance with Section 57 StBerG and the disclosure of secrets, which is punishable by law, in accordance with Section 203 StGB. This professional obligation applies parallel to the GDPR, but does not replace it. The external data protection officer must therefore be obliged to maintain client confidentiality, usually through a declaration in accordance with Section 203 of the German Criminal Code (StGB) and a written confidentiality agreement with the firm. In its instructions from October 2023, the Federal Chamber of Tax Advisors confirmed the obligation to explicitly include the DSB in the circle of professional assistants in accordance with Section 62 StBerG.

The DSB may read the client files to the extent necessary to carry out his tasks. However, he is not authorised to communicate individual cases to the outside world. This limit must be made clear in the appointment certificate, as well as in the procedural lists according to Art. 30 GDPR, in which the DPO's access to certain types of data is documented. Should the DPO report to the supervisory authority, the form of the report must be chosen such that client secrets are presented pseudonymously or anonymously, as long as this is compatible with the obligation to provide truthful information.

In practical terms, this means: The DPO receives read access to the law firm management system with audit log, not administrative rights. Write permissions are only justified where the DPO documents suggestions for improvement, for example in a dedicated compliance workspace. CIVAC separates these accesses cleanly in the CIVAC Workspace, so that every inspection remains traceable and the auditor sees the four-eyes principle proven. The appointment certificate, signed, filed, verifiable. The constellation also applies mutatis mutandis to auditors and lawyers with mandates in the same firm, which is why the appointment certificate lists all members of the firm by name.

Art. 39 GDPR defines four core tasks: informing and advising those responsible, monitoring compliance with the GDPR, advising on data protection impact assessments and cooperation with the supervisory authority. In a tax law firm, this translates into specific deliverables that are checked annually and adapted to changes in the law firm landscape.

First: maintenance of the register of processing activities in accordance with Art. 30 GDPR with typically 18 to 25 procedures per law firm. This includes client management, payroll, financial accounting, annual financial statements, tax returns, email correspondence with tax offices, DATEV cloud, telephone system, website, applicant management and newsletter. Secondly: Review and management of order processing contracts in accordance with Art. 28 GDPR with DATEV, Microsoft, telephony providers and external IT service providers. The average law firm has 12 to 18 active AV contracts to manage. Third: Processing of requests from those affected in accordance with Articles 15 to 22 of the GDPR within the one-month period, including information, correction, deletion and data portability.

Fourth: Reporting of data breaches in accordance with Article 33 of the GDPR within 72 hours of becoming aware of it. Deadline begins as soon as we become aware of it. Fifth: training of employees, at least once a year, documented with a participation list and learning goal monitoring. Sixth: Preparation of the activity report to the office management, usually quarterly. Seventh: Advice on data protection impact assessments in accordance with Art. 35 GDPR, for example when using AI-supported document recognition services or when introducing employee monitoring. For each of these tasks, CIVAC provides an audit template from the inventory of 37 prepared documents, including data breach reporting form, affected person information template and proof of training. The EU-AI Act interconnection is included in the activity reporting as soon as the law firm uses AI-supported evaluation tools. Eighthly, the role of the DPO is complemented by participation in the selection of new software, because the data protection assessment takes place before the contract is signed, not just after its introduction.

The formal order is made in writing. An appointment certificate states the time of order, area of ​​responsibility, reporting line to the office management, protection against dismissal in accordance with Art. 38 Para. 3 Sentence 2 GDPR and the amount of funds provided. The certificate is filed in the DSB's personnel file and in the law firm's compliance files. Verbal orders or orders via chat are not sufficient because they neither provide evidence of the reporting line nor the provision of the necessary resources.

The contact details of the data protection officer must be communicated to the responsible supervisory authority in accordance with Article 37 (7) GDPR. For tax firms in Baden-Württemberg this is the LfDI in Stuttgart, for Bavaria it is the BayLDA in Ansbach, and for Berlin it is the Berlin Commissioner for Data Protection and Freedom of Information. The notification is made via the respective online portal and states the name, function and work email address of the DPO, not the private address. An update is required as soon as the contact details change or the position is filled.

In addition, the contact details are included in the legal notice and data protection declaration of the law firm website. All you need to do is provide a dedicated email address, such as dsb@kanzlei-mustermann.de, which will be forwarded directly to the external representative. CIVAC provides this address with European mail routing in the CIVAC Workspace, in an ISO/IEC 27001:2022 certified data centre with EU data residency. The reporting line is mapped out in the workspace, with escalation paths for data breaches and affected party inquiries. The auditor calls, the evidence is ready. Every entry in the workspace is versioned, signed and time-stamped, so that in the event of an inspection, the order and report can be submitted to the supervisory authority in less than two minutes.

The directory according to Art. 30 GDPR is the central working document. For an average tax law firm with ten employees and 200 clients, it typically includes the following processing: client master data (address, tax ID), financial accounting (sales, account transactions), payroll accounting (social security data, sick days), annual financial statements (balance sheet items), tax returns (income, sales tax, corporation tax), client communication (e-mail, telephone), law firm management (hour recording, accounting), dunning, DATEV cloud use, Microsoft 365 use, telephone system with recording, website analysis, applicant management, employee master data, employee payroll, video surveillance entrance, access control, newsletter.

Each entry documents the purpose, legal basis, data categories, recipients, third country transfers, storage periods and technical-organisational measures. The storage period is based on Section 147 AO (ten years for accounting documents, six years for commercial letters) and Section 257 of the German Commercial Code (HGB). Depending on their content, personnel files must be retained for three to ten years. Application documents for rejected candidates must be deleted after six months unless consent has been given to remaining in the talent pool for a longer period.

CIVAC delivers the directory as a structured database in the workspace, not as an Excel list. Every change creates a version, every link to an order processing contract or a technical-organisational measure is linked. Others run compliance like a filing cabinet. We run it like software. Maintenance is carried out by the external DPO, the content is coordinated and approved in regular reviews with the office management, usually quarterly or when new procedures are introduced. When a new DATEV application is introduced, the corresponding entry is added before activation, the TOMs are cross-checked and the AV contract with DATEV is checked to ensure it is up to date. In an audit, the supervisory authorities expect not only the directory itself, but also proof that it is regularly maintained, for example through a change history with date and editor.

According to Art. 33 GDPR, the supervisory authority must be informed within 72 hours of becoming aware of a data breach if there is a risk to the rights and freedoms of those affected. The typical incidents in a tax office: sending a pay slip to the wrong client, lost USB stick with unencrypted accounting data, phishing email with DATEV access data being leaked, stolen notebook without hard drive encryption, misdirected tax documents via De-Mail or unencrypted sending of payroll tax certificates.

The reporting path begins with initial knowledge, usually by an employee or the IT service provider. This knowledge is documented in the workspace and escalated to the DPO. The DPO assesses the risk according to severity and probability, prepares the report to the supervisory authority and decides together with the office management whether those affected should also be notified (Art. 34 GDPR in the event of a high risk). In the event of extensive data leaks, for example after a ransomware incident with encryption of DATEV client accounting, clients must be notified regularly.

The reporting form includes the type of breach, affected data categories, approximate number of those affected, countermeasures taken and contact details of the DPO. CIVAC keeps the reporting form available as a fillable template in the workspace and logs the time stamps: initial knowledge, DSB escalation, risk assessment, report, notification. This chain is audit-proof, documented, Section 33-proof. A root cause analysis is then carried out with measures that are updated in the TOM directory. The typical processing time from receipt to sent report is six to 24 hours. The activity reports of the supervisory authorities show that a complete, precise initial report significantly speeds up the subsequent clarification of the facts and regularly reduces the amount of fines.

The remuneration of the external DPO depends on the effort and size of the mandate. Common models are a monthly flat fee, an hourly quota or a mixture. Experience has shown that for a tax law firm with ten employees and 200 clients, the effort is 4 to 8 hours per month, with peaks during audits, data breaches and the introduction of new procedures. For larger law firms with 30 or more employees, the effort increases to 10 to 20 hours per month because additional locations, more order processing contracts and higher training frequencies have to be processed.

Standard flat rates are between 250 and 700 euros net per month, depending on specialization, regional anchoring and services included. CIVAC operates a two-tier model: Licence the workspace for your internal representatives, or have our representatives order it. With Officer-as-a-Service, the initial intake is completed in 2 working days, instead of the classic 2 to 6 weeks. In the licence model, the law firm receives the workspace with the 490 audit templates, but keeps the appointment of the DPO internally, for example with a permanently employed data protection coordinator with DPO certification.

The contract regulates: time of order, catalogue of tasks with differentiation from IT security and legal advice, remuneration, availability (usual: 24 hours for e-mail answers, 4 hours in the event of data breaches), contract term (usually 24 months), protection against dismissal in accordance with Art. 38 Para. 3 GDPR, liability and professional liability insurance of the DSB. Liability coverage of at least 1 million euros is standard. The CIVAC FAQ provides model clauses and comparative values ​​for law firms of different sizes, including the difference between pure licence and full officer-as-a-service. For a medium-sized law firm with 25 employees, the total net expenditure over 24 months is around 12,000 to 16,000 euros.

If the external data protection officer changes, an orderly handover is crucial. The handover file includes: appointment certificate from the predecessor (cancellation), current list of procedures with status and version, all order processing contracts with status and contractual partner, the list of ongoing inquiries from those affected, the data breach register of the last 36 months, proof of training from the last 24 months, the current activity report and correspondence with the supervisory authority. In addition, there are data protection impact assessments for particularly risky procedures, such as when using new AI-supported document capture or employee monitoring software.

The formal deregistration of the previous DPO with the supervisory authority takes place promptly, the new registration of the CIVAC DPO within ten working days. The legal notice and data protection declaration of the law firm website will be updated. In the first week after taking over, the new DPO checks the directory to ensure it is up to date, identifies gaps in the AV contracts and arranges an appointment with the office management for the reporting line. A 60-minute handover appointment between the old and new DSB is usual, during which the previous person responsible explains open points and the correspondence with the supervisory authorities.

CIVAC structures this handover along a checklist with 42 check points and transfers the existing documents to the workspace. Versioning, linking to the TOMs and the reporting line to the office management are documented after the initial recording. If the previous DPO hands over documents in an unstructured form, for example as a PDF collection, CIVAC will take over the structuring in the workspace without a separate charge, provided the officer-as-a-service contract exists. In the first 30 days after takeover, the office management receives a handover report that documents the inventory, identified deficiencies, planned immediate measures and the roadmap for the next six months.

CIVAC is a compliance platform and officer-as-a-service based in Germany. We appoint external data protection officers for tax firms, auditing firms and law firms. The initial recording takes place in 2 working days with an appointment certificate, notification to the supervisory authority and an initial inventory of the procedure directory. The workspace content is hosted in an ISO/IEC 27001:2022 certified data centre with EU data residency, so that there are no third-country transfers.

Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same file: 490 audit templates, documented reporting line, data breach path according to Art. 33 GDPR, EU data residency. The auditor calls, the evidence is ready. The remuneration is shown transparently, without hidden additional costs for using the templates or versioning the documents.

If your law firm has reached the threshold according to Section 38 BDSG or carries out extensive processing of special data categories with DATEV, Microsoft 365 and payroll, the order is mandatory. You will receive initial advice on the obligation to order, the contract model and the handover from the previous DSB free of charge. Write to info@civac.de or use the contact form on civac.de. We will contact you within one working day and arrange a 30-minute appointment to take stock. You will then receive a concrete offer with a catalogue of tasks, availability windows and contract model. If necessary, we can combine the order with an ISO/IEC 27001:2022 ISMS and a whistleblower reporting point in accordance with the HinSchG, which is already mandatory in law firms with over 50 employees. CIVAC can represent a multiple order within the same initial intake, so that the appointment certificate, reporting line and workspace access are managed consistently in a single platform. Turn reading into an assignment.