Officer appointment duty check
German law does not leave officer appointments to judgement: each role has a statutory trigger, a prescribed form of appointment and a protected standing inside the company. Pick your industry and headcount, then add the circumstances that trigger further duties. For each role you get the threshold, the form of appointment, the required expertise, the officer's standing and the consequence of failing to appoint.
No signup · runs in your browser · nothing you enter is transmitted
Optional. The statutory triggers rarely key off plain headcount — tick what applies to you.
Pick an industry and headcount to see the appointment duties.
There is no single German law on company officers: appointment duties are scattered across data protection law (Art. 37 GDPR, sec. 38 BDSG), occupational safety law (ASiG, sec. 22 SGB VII, DGUV Rule 1), environmental law (secs. 53 and 58a BImSchG, sec. 59 KrWG, sec. 64 WHG), dangerous-goods and radiation law (GbV, sec. 70 StrlSchG) and supervisory law (sec. 7 GwG, sec. 12 HinSchG, sec. 4 LkSG). The triggers are built differently: sometimes a headcount, sometimes a type of installation, sometimes an activity. What most of them share is that the appointment has to be made in writing, that the appointee must hold demonstrable expertise, and that the role carries a protected standing — freedom from instructions in the technical task, a prohibition on detriment, and a direct reporting line to management. Failing to make a legally required appointment is generally a regulatory offence; in data protection and anti-money-laundering law it also carries substantial fines.
Orientation only — not legal advice. This check reflects the typical triggers; whether an appointment duty applies in your case depends on your installations, activities, processing operations and quantity thresholds, which this tool does not know. Details on thresholds, form, expertise and fines are shown only where they follow from the norm; for all other roles only the legal basis is named. Sector-specific and federal-state rules, and conditions imposed in permits, are not covered.
Frequently asked
- When must a data protection officer be appointed?
- Under the first sentence of sec. 38(1) BDSG, where as a rule at least 20 persons are constantly engaged in the automated processing of personal data. Irrespective of that number, the duty applies under Art. 37(1) GDPR where the core activity consists of regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of special categories of data under Art. 9 or of criminal conviction data under Art. 10 GDPR, and for public authorities and bodies. The second sentence of sec. 38(1) BDSG adds a duty where processing operations are subject to a data protection impact assessment under Art. 35 GDPR, or where personal data is processed commercially for the purpose of transfer, anonymised transfer, or market and opinion research.
- From how many employees do you need safety representatives?
- Under sec. 22(1) SGB VII, safety representatives (Sicherheitsbeauftragte) must be appointed in undertakings that regularly have 50 or more employees, with the involvement of the works or staff council. Where there are regularly more than 20 and fewer than 50 employees, one safety representative must be appointed if the risk assessment under sec. 5 ArbSchG shows a particular hazard to life and health; the accident insurance institution may order the appointment. Sec. 20 of DGUV Rule 1 still names the former threshold of more than 20 employees and has not been updated — the higher-ranking SGB VII prevails. Safety representatives support the employer and must not be placed at a disadvantage for performing their duties (sec. 22(3) SGB VII). They replace neither the occupational safety specialist nor the occupational physician: both must be appointed under the Occupational Safety Act regardless of headcount.
- Does the appointment have to be in writing?
- In most cases, yes. Secs. 2(1) and 5(1) ASiG expressly require the occupational physician and the occupational safety specialist to be appointed in writing, with their duties expressly defined. For officers under the Federal Immission Control Act, sec. 55(1) BImSchG requires a written appointment stating the duties precisely; via sec. 60(3) KrWG and sec. 66 WHG the same applies to waste and water protection officers. The dangerous goods safety adviser, by contrast, only has to be appointed in text form under sec. 3(1) GbV. The radiation protection officer must likewise be appointed in writing under sec. 70(1) StrlSchG. The GDPR prescribes no form for the data protection officer — but the designation should be documented for evidential reasons, given the accountability principle in Art. 5(2) GDPR.
- Which appointments must be reported to an authority?
- The contact details of the data protection officer must be published and communicated to the competent supervisory authority under Art. 37(7) GDPR. The appointment of an immission control or major incident officer must be notified to the competent authority without undue delay under the second sentence of sec. 55(1) BImSchG; the same applies to waste and water protection officers via the references in sec. 60(3) KrWG and sec. 66 WHG. The radiation protection officer must be notified to the competent authority under sec. 70(4) StrlSchG, with the evidence of expertise attached. In anti-money-laundering law, the appointment of the AML officer and the deputy must be notified to the supervisory authority in advance under sec. 7(4) GwG, and the inclusion officer must be named to the employment agency and the integration office under sec. 163(8) SGB IX. For the occupational safety specialist, the occupational physician and safety representatives there is no duty to notify an authority.
- What happens if an officer is not appointed?
- Failing to appoint is as a rule a regulatory offence. In data protection, breaching the designation duty in Art. 37 GDPR can be fined up to EUR 10 million or 2 % of total worldwide annual turnover under Art. 83(4)(a) GDPR. In anti-money-laundering law, sec. 56 GwG provides for fines that can go well beyond the standard range for serious, repeated or systematic breaches. Failing to set up an internal reporting channel where required risks a fine under sec. 40 HinSchG. On top of that comes management's organisational responsibility across all areas: omitting supervisory measures triggers personal liability under sec. 130 OWiG, and where harm occurs a missing appointment pushes responsibility back onto company management.
- How does this differ from the orientation check on the roles page?
- The orientation check turns industry and headcount into a shortlist of roles that could be relevant for a company like yours. This duty check works one level deeper: it takes the same shortlist and answers the appointment question for each role — which statutory trigger creates the duty, in what form the appointment must be made, what expertise must be evidenced, what protected standing the appointee holds inside the company, and what failing to appoint costs. You can also flag circumstances that create an appointment duty regardless of company size.