Compliance officer and data protection officer: roles, duties, separation

The role of the data protection officer is regulated in Articles 37 to 39 of the GDPR, that of the compliance officer results from Section 130 OWiG, Section 91 Paragraph 2 AktG and industry-specific requirements such as Section 25a KWG or Section 25h KWG. Both functions are responsible for ensuring legal compliance within the company, but their mandate, reporting line and liability standards are fundamentally different.

This article neatly categorizes the tasks. You will find out what the legal basis is, where the conflict of interest between the roles arises, what audit-proof proof looks like and when a personal union remains permissible. The end result is a practical decision-making path for management who have to fill both functions without falling into duplicate structures.

The data protection officer (DPO) is a function defined under European law. Art. 37 Para. 1 GDPR specifies the ordering obligation for authorities, for companies with core activities in regular and systematic monitoring and for processing special categories of personal data. Section 38 BDSG tightens the threshold in Germany to generally 20 people who are constantly involved in the automated processing of personal data.

The Compliance Officer (CO) does not have its own central legal basis. It is derived from the guarantor position of the management in accordance with Section 43 GmbHG, Section 93 AktG and Section 130 OWiG, which sanctions breaches of supervisory duty. Sector-specifically, Section 25a KWG for banks, Section 80 WpHG for securities service providers and BaFin's MaRisk circular catalogue supplement the obligation structure. In regulated sectors, the function is actually mandatory, in other sectors it follows from the principle of proper management.

The difference shapes everything that follows: The DPO is a legally anchored supervisory function with freedom to issue instructions. The CO is an operational control function with the authority to issue instructions within his mandate. Anyone who combines both roles in one person must make this distinction clear in writing. You can find an overview of all ordering obligations on the Compliance Officer role page.

The DSB has a conclusively defined catalogue of tasks. Art. 39 Para. 1 GDPR specifies information and advice for the person responsible, monitoring compliance with the regulation, raising awareness and training employees, advice in connection with data protection impact assessments and cooperation with the supervisory authority. The DPO does not carry out processing activities himself and does not decide on purposes and means. This distance is protection and duty at the same time.

The CO has a broader, less selective mandate. He creates the compliance management system according to IDW PS 980, is responsible for risk analysis, guidelines, training, the whistleblower channel according to HinSchG and the clarification of suspected cases. He is usually authorised to give instructions to departments when it comes to implementing controls. In companies with a MaRisk commitment, the CO also develops the risk culture and reports to management and the supervisory board.

In practice, both fields overlap on topics such as order processing, international data transfers, AI governance according to the EU AI Act or supplier risks according to LkSG. A clear interface matrix is ​​needed here, otherwise blind spots or duplication of work will arise. The appointment certificate, signed, filed, verifiable.

Art. 38 Paragraph 3 GDPR requires that the DPO does not receive any instructions regarding the exercise of his duties. He reports directly to the highest management level and may not be removed or disadvantaged because of the fulfilment of his duties. This freedom from instructions is the core of the function. It structurally distinguishes the DPO from operational functions.

The CO is not legally protected in a comparable way. His position results from the internal order file, the employment contract and, if necessary, from regulatory requirements. In banks, Section 25a of the KWG provides for a reporting line to management; in other sectors, this must be regulated organizationally. What is important is that the CO must not end up in a position where he controls his own decisions. Otherwise, the supervisory obligation according to Section 130 OWiG fails due to the principle of separation of execution and control.

For management this means: reporting path, escalation path and documentation obligations must be clearly defined separately for both roles. The NIS 2 implementation in Germany further tightens these requirements for affected companies because the management there is personally liable for the implementation. The auditor calls, the evidence is ready.

The DSB is primarily liable under the employment contract. The GDPR does not provide for personal external liability towards those affected that is subject to a fine. Fines according to Art. 83 GDPR are directed against the person responsible or the processor, i.e. the company. However, the DPO can be held liable within the company if it grossly negligently violates its advisory obligations.

The CO bears a significantly broader liability risk. In its decision of July 17, 2009 (5 StR 394/08), the Federal Court of Justice made it clear that the compliance officer can be given a criminal guarantor position. If he violates his duty of supervision, he is threatened with fines according to Section 130 OWiG of up to 1 million euros as well as criminal consequences for aiding and abetting through omission. In regulated industries, supervisory sanctions are added.

Both functions can generally be insured through D&O insurance, but the market differentiates between board liability and special function liability. The fines according to Art. 83 GDPR of up to 20 million euros or 4 percent of global annual turnover affect the company, but reduce the willingness of insurers to reduce high deductibles. A clean appointment certificate with resource commitment, reporting path and task description is the basis of every cover.

The question of personal union arises particularly in medium-sized businesses. Legally, the GDPR does not expressly prohibit a dual role. Art. 38 Para. 6 GDPR even allows the DPO to have other tasks and obligations, provided this does not result in a conflict of interest. The European Data Protection Board has in WP 243 rev. 01 specifies that managerial positions with the power to decide on the purposes and means of processing are incompatible with the DPO role. Typically excluded are managing directors, IT management, HR management and marketing management.

The CO, on the other hand, is allowed to have operational responsibility because that is part of his function. If a person combines CO and DPO, he or she, as DPO, must be able to monitor the CO's compliance decisions without auditing himself. This is possible in smaller companies with clear data processing, but no longer possible when it becomes more complex. The supervisory authorities in Bavaria, Baden-Württemberg and North Rhine-Westphalia have assessed staff unions as an indication of structural deficiencies in several fine proceedings.

A pragmatic solution is separation via external mandates. The DSB function is outsourced via the external data protection officer, while the CO remains internal. This creates structural independence without doubling personnel costs. CIVAC is a compliance platform and officer-as-a-service and provides both functions with appointment certificate within 2 business days.

CO and DSB meet regularly at four points. Firstly, with order processing contracts according to Art. 28 GDPR. The DSB checks the viability of data protection law, the CO evaluates the contractual risk distribution and the supplier risks. Secondly, with AI systems: The EU AI Act, in force since August 1, 2024, requires risk management for high-risk systems in accordance with Article 9 and data quality requirements in accordance with Article 10. Here, data protection impact assessment and AI risk analysis run in parallel.

Thirdly, with whistleblower protection according to the HinSchG. The internal reporting office according to Section 12 HinSchG traditionally falls within the CO area of ​​responsibility, but personal data of the whistleblower is subject to the GDPR. Here the position needs a coordinated processing directory, a TOM description and a clear role definition. Fourthly, with the supply chain due diligence obligation according to LkSG: This is where compliance risk analysis and data protection are combined in complaint procedures, audits and supplier monitoring.

A clean interface matrix defines for each processing situation who decides, who advises and who documents. Ideally, it is located in the same platform in which the appointment certificates, reporting paths and audit templates are managed. Others run compliance like a filing cabinet. We run it like software.

Both roles are subject to accountability. Art. 5 Para. 2 GDPR requires the person responsible to provide proof of compliance. For the CO, the obligation to provide proof arises from Section 130 OWiG, IDW PS 980 and from industry-specific supervisory standards. In audits, supervisory procedures and after incidents, it is carefully examined whether the function is organizationally embedded, technically qualified and demonstrably active.

The minimum components of an audit-proof evidence path are: appointment certificate with date, task description and resource commitment; Reporting line to management with documented meetings; training courses with proof of participation; Risk analysis with update frequency; Action plan with deadlines and responsible persons; and incident logs with response times. For the DSB, the activity report is added, for the CO, the annual compliance report to the management and, if necessary, the supervisory board.

In the event of a dispute, it is not the existence of individual documents that decides, but rather their consistency. An appointment certificate without a reporting line appears formal. A risk analysis without measures has a symbolic effect. In practice, supervisory authorities and public prosecutors evaluate the interaction of the elements. Audit-proof, documented, Section 130-proof. The ISO 27001:2022 requirements provide a recognised framework for IT-related compliance.

The market prices for internal positions, depending on the industry and region, are between 70,000 and 130,000 euros annual salary for a compliance officer and 60,000 to 110,000 euros for a data protection officer. There are also training, tooling, insurance and travel costs. For medium-sized companies, double staffing is often difficult to achieve, especially when there is only partial capacity.

External orders are between 800 and 4,500 euros per month per role, depending on the volume. They have the advantage of structural independence and are often technically superior for small to medium-sized data processing because several mandates create routine. For sensitive industries such as health, financial services or critical infrastructure, a hybrid model is recommended: internal contact person plus external specialist function.

Licence the workspace for your internal representatives or have our representatives appointed. The CIVAC platform covers 25 agent roles, provides 490 ready-to-use audit templates and bundles the appointment certificate, reporting line and action plan in one EU data residence. The dual-model frame allows you to gradually switch between external mandates and internal functions as you grow, without losing the documentation chain.

The separation of compliance officer and data protection officer is not a bureaucratic exercise, but rather a structural requirement for liability-proof supervision. Anyone who clearly sets up both roles gains a clear escalation path, a verifiable reporting line and a resilient defensive position against supervisory authorities, insurers and public prosecutors. Anyone who blurs them risks bias, fines and, in an emergency, personal criminal liability for management and officials.

If you want to fill, restructure or professionalize both roles, we will check the ordering requirement, interface matrix and evidence path with you. The CIVAC platform centrally provides the appointment certificate, audit templates and the 24/72 reporting path according to NIS-2, with EU data residency and ISO 27001:2022 compliant ISMS. Licence the workspace for your internal representatives or have our representatives order it.

Turn reading into a mandate. Write to info@civac.de or use the contact form on civac.de. We will contact you within 2 working days with a concrete proposal for the role architecture, a draft appointment certificate and a course of action for the first 90 days.