KlarComply
DEENNL
Sign in Quick check
KlarComply
Quick check
DEENNL

Product

KlarComply platformStaff trainingCompliance kit (free)Quick check (free)AI labellingAI policy generatorVerify a certificateAI Officer courseDPO check (data protection)For individuals

Solutions

Beauty salonsHair salonsHotelsPhysiotherapy practicesDental practicesTrades businessesCar repair shopsAdvertising agenciesTax and accounting firmsLaw firmsEstate agentsAll industries
Pricing
For partners

Knowledge

All articlesLegal statusArticle 4: training obligationArticle 50: labellingPenalties under Article 99The AI Act for SMEsFAQ

Company

About KlarComplyContact & legal noticeLinkedIn

Account & legal

Sign in / My areaPartner sign-inLegal noticePrivacyTermsWithdrawal noticeDPACancel contracts hereWithdraw from contract here

Do we need a data protection officer?

Five questions, two minutes — and you get a reasoned result under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG), including a text module for your records. Free, no sign-up; nothing is transmitted, the check runs entirely in your browser.

1 · Where is your company based (or where do your staff work)?

2 · How many people at your company are permanently engaged in the automated processing of personal data?

Count every person who regularly works at a computer with customer, staff or supplier data — including part-time staff. The threshold comes from Section 38 BDSG and applies only to Germany.

3 · Does your core activity consist of large-scale, regular and systematic monitoring of individuals?

4 · Does your core activity consist of large-scale processing of special categories of data (health, religion, biometrics and so on) or of data relating to criminal offences?

5 · Are you a public authority or public body?

And the obligations that remain in any case?

With or without a data protection officer: the record of processing activities, data processing agreements, measures under Art. 32 and the demonstrable awareness training of your team remain your responsibility (accountability, Art. 5(2) GDPR). The free two-minute check shows where your company stands on the AI Act and data protection.

To the free two-minute check

Frequently asked questions

From when must a company appoint a data protection officer?

EU-wide, appointment is risk-based (Art. 37 GDPR): mandatory for public authorities and for core activities involving large-scale systematic monitoring or large-scale processing of special categories of data. In Germany, Section 38 BDSG adds a further rule: mandatory from 20 people permanently engaged in the automated processing of personal data. Malta and Austria have no such additional threshold.

Will the 20-person threshold of Section 38 BDSG be abolished?

Announced, but not decided: the Federal Modernisation Agenda of 4 December 2025 promises a bill repealing Section 38(1) BDSG by the end of 2026. As of 1 September 2026 no bill has been tabled — the threshold applies unchanged. As soon as that changes, it will be on our legal status page.

No data protection officer — do the data protection obligations then fall away?

No. Without a duty to appoint, all other obligations remain: the record of processing activities (Art. 30), data processing agreements (Art. 28), technical and organisational measures (Art. 32) and demonstrable staff training. Precisely then: document all the more.

This tool is a documentation and orientation aid, not legal advice. Legal status as of 1 September 2026; borderline cases (e.g. “core activity”, “large-scale”) should be clarified with a qualified adviser. No input is transmitted or stored.