External DPO vs. Internal DPO in Germany: When Outsourcing Wins

Under Art. 37 GDPR and § 38 BDSG, German companies that process personal data on a large scale or employ 20 or more persons engaged in automated processing must designate a Data Protection Officer (DPO). The law leaves the choice open: internal employee or external service provider. In practice, however, the decision drives cost, liability, independence and audit posture for the next three to five years, and supervisory authorities increasingly examine the rationale behind the appointment, not only the appointment itself.

This article compares both models against six criteria that the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) and the federal state authorities actually examine in audits: independence under Art. 38(3) GDPR, qualification under Art. 37(5) GDPR, availability under Art. 38(4) GDPR, cost over a 36-month horizon, liability allocation and documentation discipline. It is written for German entities, including GmbH and AG structures, and addresses the specific question why an external DPO is, in most mid-market cases, the more defensible choice. CIVAC, a German Compliance-Plattform und Officer-as-a-Service provider, supplies the operating model behind the analysis and supports 25 officer roles on one stack.

Art. 37 GDPR requires a designated DPO in three cases: when processing is carried out by a public authority, when core activities require regular and systematic monitoring of data subjects on a large scale, or when core activities consist of large-scale processing of special categories of data under Art. 9 or 10 GDPR. § 38 BDSG adds the German specificity that any controller or processor with at least 20 persons constantly engaged in automated processing must also designate a DPO, regardless of scale. This threshold catches the typical German mid-market company well before international benchmarks would.

The statute is neutral on internal versus external. Art. 37(6) GDPR explicitly states that the DPO may be a staff member or fulfil the tasks on the basis of a service contract. What the law is not neutral about is independence under Art. 38(3) GDPR, expertise under Art. 37(5) GDPR, the reporting line directly to the highest management level under Art. 38(3) GDPR, and adequate resources under Art. 38(2) GDPR. Many German companies appoint an internal DPO without checking whether these four pillars hold up to a supervisory audit, and only discover the gap when the first complaint reaches the authority.

CIVAC issues a formal Bestellurkunde for every externer Datenschutzbeauftragter mandate, with the reporting line, scope and substitution arrangement documented from day one. Bestellurkunde, unterschrieben, abgelegt, belegbar. This single document closes the most common audit finding before it can occur.

The German Federal Labour Court ruling 9 AZR 79/19 (2020) and consistent guidance from the German Data Protection Conference (DSK) clarify that the following internal roles structurally conflict with the DPO function: Head of IT, Head of HR, Head of Marketing, Head of Sales, Managing Director, Compliance Officer where they instruct on processing, and any role that determines purposes or means of processing under Art. 4(7) GDPR. In a typical 150-employee German mid-market company, this exclusion list captures most of the obvious internal candidates and leaves a thin bench.

What remains are roles such as Legal Counsel without operational data responsibility, Quality Manager or a dedicated Privacy Manager. The first two often lack the time and the regulatory depth. The third is rare in companies below 500 employees because it requires a full-time hire at 65,000 to 90,000 EUR annual gross plus employer overhead. The internal DPO question therefore frequently collapses into a single, awkward choice: do you hire a dedicated person, or do you appoint someone with a conflict and hope the authority does not look closely at the org chart?

An external DPO sidesteps the conflict entirely. The service provider has no operational role in your business and cannot, by construction, instruct on processing. Independence is built in, not negotiated case by case. For supervisory authorities, this is the first checkbox they tick when reviewing a DPO appointment, and a checked box is a defensible posture. Andere führen Compliance wie einen Aktenschrank. Wir führen sie wie Software.

Art. 37(5) GDPR requires the DPO to possess expert knowledge of data protection law and practices. Supervisory authorities expect at minimum a structured training programme (TÜV, udis, GDD or equivalent), continuous professional development of 40 to 60 hours per year and demonstrable case experience across multiple processing scenarios. A typical internal appointee starts with zero of these credentials and reaches a defensible baseline only after 12 to 18 months of part-time effort, during which the authority risk is real and the company is on the hook.

Substitution is the second, less visible gap. The DPO must be reachable for data subjects under Art. 38(4) GDPR. Internal DPOs go on holiday, fall ill or leave the company. If the company has no documented deputy with equivalent qualification, the appointment is operationally broken even if the paperwork looks intact. External providers solve this through a team model: every CIVAC mandate is staffed with a lead officer plus a documented deputy from the same pool, and the substitution arrangement is recorded in the Bestellurkunde and the Berichtslinie.

The hidden tax of internal appointments is the qualification ramp plus the substitution risk. Companies that compare salary alone are comparing the wrong number. The right comparison is salary plus training (5,000 to 12,000 EUR per year), tools (2,000 to 8,000 EUR per year), legal advisory backstop (5,000 to 15,000 EUR per year), and a documented deputy (50 to 100 percent of the lead cost). CIVAC bundles all of this into the service contract and the platform fee, with no surprise add-ons during the contract term.

The following figures are based on German market rates as of 2026 and reflect a mid-market company with 80 to 300 employees, two to four processing systems of medium complexity and one international transfer covered by Standard Contractual Clauses. All numbers are total cost of ownership, not list price, and include the substitution reserve that most internal models overlook in the first budgeting round.

Internal DPO, full-time: Gross salary 70,000 to 90,000 EUR per year, employer overhead 20 to 25 percent, training 8,000 EUR per year, tools and legal backstop 12,000 EUR per year, deputy reserve 15,000 EUR per year. 36-month total: 320,000 to 410,000 EUR. Internal DPO, part-time at 40 percent role share: Allocated cost 40,000 to 55,000 EUR per year, training 5,000 EUR per year, tools 8,000 EUR per year, substitution risk reserve 10,000 EUR per year. 36-month total: 165,000 to 234,000 EUR, with a conflict-of-interest review still pending. External DPO via CIVAC: Service fee 6,000 to 24,000 EUR per year depending on scope, including 490 templates, audit support, documentation, named deputy and Bestellurkunde. 36-month total: 18,000 to 72,000 EUR.

The cost gap is structural, not promotional. External providers amortise expertise across many clients, internal appointees cannot. The decision criterion is therefore rarely cost in isolation. It is whether the internal appointment can clear the independence, qualification and substitution bars at a defensible total cost. In most German mid-market cases, it cannot, and the cost difference funds the rest of the compliance portfolio.

The DPO is not personally liable for the controller's processing decisions under the GDPR. The controller carries the fine risk under Art. 83 GDPR, with fines up to 20 million EUR or 4 percent of global annual turnover, whichever is higher. However, the DPO can be liable on three separate tracks: civil liability if their advice is grossly negligent and causes damage, labour-law consequences if internal (warning, dismissal proceedings, claw-back of severance), and criminal liability under § 42 BDSG if data is unlawfully transferred or processed with intent or for enrichment.

For internal DPOs, the labour-law track is the awkward one. The DPO enjoys special dismissal protection under § 38(2) BDSG in conjunction with § 6(4) BDSG, but the protection is not absolute and disputes are expensive and slow. For external DPOs, the liability sits with the service provider under the service contract, capped, insured and predictable. CIVAC carries a Vermögensschadenhaftpflicht of at least 5 million EUR per case for DPO mandates, documented in the master service agreement and reissued annually.

The audit-defensibility angle is more important than the headline fine. When the supervisory authority requests evidence under Art. 58(1) GDPR, the question is who can produce the records within the requested window, typically 14 to 30 days. External providers ship with a documented evidence base accessible through the Workspace. Internal DPOs without dedicated tooling often cannot meet the window without a scramble. Der Prüfer ruft an, der Nachweis liegt bereit. That sentence summarises the entire audit-readiness argument.

Art. 30 GDPR requires a Record of Processing Activities (RoPA). Art. 35 GDPR requires Data Protection Impact Assessments (DPIA) for high-risk processing. Art. 33 GDPR requires breach notification within 72 hours from awareness. Each of these is a document, a workflow and an evidence trail with timestamps. In supervisory audits, the question is never whether the law applies. It is whether you can produce the document, with versioning, sign-off and the underlying assessment trail intact.

Internal DPOs typically inherit a patchwork of Excel files, Word templates and shared drives that grew organically over years. The patchwork works until the first audit, after which it does not. External providers ship with a structured Workspace from day one. CIVAC's Compliance-Plattform und Officer-as-a-Service includes 490 audit-ready templates covering RoPA, DPIA, breach playbook, joint-controller agreements, Art. 28 GDPR processor contracts, international transfer assessments and data subject request workflows, all wired to the German legal baseline and updated when the law moves.

The dual-model frame matters here: Lizenzieren Sie den Workspace für Ihre internen Beauftragten, oder lassen Sie unsere Beauftragten bestellen. A company with an internal DPO can still license the Workspace to fix the documentation gap without changing the appointment. A company with no DPO at all can have CIVAC appoint one and operate the Workspace end-to-end. The two models share the same evidence base, which is what audit defensibility requires and what supervisory authorities increasingly expect.

External is not always the better answer, and an honest comparison must say so. Three scenarios favour an internal appointment. First, very large enterprises above 2,000 employees with dedicated privacy budgets, where a full-time internal DPO plus a privacy team is the standard model. The cost gap closes, the value of in-house institutional knowledge grows, and the volume of internal queries justifies a permanent presence. Second, highly regulated processors such as banks under BAIT or insurers under VAIT, where the DPO must coordinate daily with risk, compliance and IT security functions, and physical proximity matters more than the marginal independence advantage.

Third, public authorities, where § 38 BDSG and constitutional law nuances often favour an employed officer reporting to the head of authority, with a clear civil-service career track. For the remaining 80 to 90 percent of German mid-market companies, the external model is structurally superior on the four criteria that auditors actually check: independence, qualification, substitution and documentation. The decision then becomes which external provider, on what scope and with what service-level agreement.

Look for a provider that issues a formal Bestellurkunde, names the lead officer and deputy by person, documents the reporting line to the highest management level under Art. 38(3) GDPR, provides a structured Workspace rather than a quarterly call, and commits to a 2-working-day onboarding SLA rather than the classic 2 to 6 weeks. Audit-fest, dokumentiert, § 38 BDSG-fest. That is the standard. Anything less is paperwork waiting to fail at the next audit.

A DPO appointment rarely stands alone in the German compliance landscape. Mid-market companies typically need a coordinated set of officers: Data Protection Officer under Art. 37 GDPR, Information Security Officer for NIS-2 transposition and ISO/IEC 27001:2022 alignment, Compliance Officer under IDW PS 980, Whistleblowing Office under HinSchG since July 2023, ESG officer for CSRD reporting from 2026 and 2027, and depending on the sector, Money Laundering Officer under GwG, Hazardous Goods Officer under GbV, Health and Safety Officer under ASiG and others. CIVAC covers 25 officer roles, all live, on a single Compliance-Plattform und Officer-as-a-Service.

The integration argument is operational, not commercial. A personal data breach under Art. 33 GDPR and a security incident under § 32 BSIG (NIS-2 transposition) often arise from the same event, the same forensic trail and the same affected systems. If the DPO and the Informationssicherheitsbeauftragte sit in different organisations with different evidence bases and different reporting cycles, the 24-hour early warning and 72-hour breach notification windows become operationally difficult to meet. On a single platform, the same incident triggers both workflows from a shared evidence trail, with clear ownership and timestamps.

Companies that pick an internal DPO and then fragment the rest of their officer landscape across freelancers and law firms typically discover the integration gap during the first cross-functional audit. The cost of fixing it later is higher than the cost of building it correctly at the start, and the disruption is harder to schedule around live operations.

The decision matrix is short and survives most board reviews. If you have fewer than 500 employees, no dedicated privacy budget, and no internal candidate who clears the Art. 38(3) GDPR independence bar without contortion, the external model wins on cost, qualification, substitution and documentation. If you have more than 2,000 employees, a dedicated privacy budget and a regulated-sector profile, the internal model becomes competitive and often preferable. Everything in between deserves a structured 90-minute review against the four supervisory-audit criteria before the appointment is finalised.

CIVAC's positioning is the Compliance-Plattform und Officer-as-a-Service. Lizenzieren Sie den Workspace für Ihre internen Beauftragten, oder lassen Sie unsere Beauftragten bestellen. The dual model means the decision is not binary or final. Many German companies start with an external DPO mandate including the Workspace, transition to an internal DPO after two to three years once the documentation base is mature and the company has scaled past the threshold, and keep the Workspace plus advisory backstop for continuity. Others stay external for the full lifecycle because the economics never favour an internal hire.

For a structured comparison against your specific scope, including a fixed-fee proposal, a draft Bestellurkunde and a Workspace demo with the 490 templates loaded against your processing inventory, contact CIVAC at info@civac.de or via the contact form linked from the FAQ at civac.de. The first review call is typically 30 minutes and produces a written recommendation within five working days. Aus dem Lesen einen Auftrag machen.