Skip to main content
GDPR and BDSG · self-check

Do you need a data protection officer?

At most eight questions, two minutes: the check shows whether the GDPR and the German Federal Data Protection Act (BDSG) probably require you to appoint one, which duties follow and what is still open.

Start the check

Free · up to 8 questions · no sign-up

The DPO check

Pick one answer per question. You see the result right away, with the legal reference for every point.

Question 01 of 8

Is your organisation a public authority or another public body?
How many people in Germany usually work with personal data on a computer on a regular basis?

Everyone who regularly handles emails, customer data or HR data counts, including owners and trainees.

Does your core business consist of large-scale, regular and systematic monitoring of people?

For example tracking and profiling as a service, credit agencies or video surveillance for clients. Processing your own staff data is not a core activity.

Does your core business involve large-scale processing of health, biometric or other sensitive data, or data on criminal offences?

A single medical practice or law firm is usually not large-scale; a hospital group or a laboratory is.

Do you carry out processing that requires a data protection impact assessment?

Typical for new technologies, large-scale monitoring, scoring or high-risk processing of sensitive data (Art. 35 GDPR).

Do you process personal data commercially in order to transfer it, or for market or opinion research?

For example address trading, data brokerage or survey institutes.

Is your company part of a group of companies?
Have you already appointed a data protection officer?

Result …

What to look at

The duties that then apply

An assessment based on your answers, not legal advice. For a binding assessment, please consult your legal counsel.

The full evaluation as a PDF

We send you your result with every duty, its legal reference and your answers. If you like, we show you in a short call how preeco | data protection supports your data protection officer’s work.

  • Result and duties with their reference in the GDPR and BDSG
  • Your open points with concrete next steps
  • Your answers, ready to pass on to management or legal counsel

Privacy
We use your answers and contact details to send you the evaluation and to contact you. Please see our privacy policy.

Thank you for your inquiry!

Thank you. We will email you the evaluation shortly and get in touch for a quick follow-up.

FAQ

Frequently asked questions

In Germany, under Section 38 (1) BDSG, as soon as at least 20 people are usually and constantly engaged in the automated processing of personal data. Regardless of size, the obligation applies to core activities involving large-scale monitoring or sensitive data (Art. 37 GDPR), to processing that requires a data protection impact assessment, and to commercial data transfer or market and opinion research.

What matters is whether someone constantly works with personal data on a computer, not the type of contract. According to the supervisory authorities, owners and trainees count too.

Both are allowed (Art. 37 (6) GDPR). What matters is expertise and the absence of a conflict of interest: anyone who decides on the purposes and means of processing, such as the managing director, is usually ruled out. An internal data protection officer appointed under the obligation enjoys special protection against dismissal.

No. The check is an assessment based on your answers and names the legal reference for every point. For a binding assessment of your case, please consult your legal counsel.