5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
External data protection officer
Obligations, processes and evidence from a single source
Can data protection in your company no longer be handled on the side? Then you need an independent function that brings obligations, processes, evidence and communication together. We take on or support the external DPO function.
Please enter a short description first.
Initial contact is free of charge. Before any costs arise, we will point this out to you expressly.
Response on working days within 24 hours
As of: 23 October 2026
Takeover phase2 of 5
- Designation obligation reviewedPresent
- Contact details and notificationPresent
- Systems and data flowsReview
- Service provider chainReview
- Open incidentsSpecialist mandate possibleMissing
Review point: Do the documents match the actual processing?
- 1Assess your needsObligation and starting point
- 2Take on the functionDesignation and priorities
- 3Ongoing steeringAudits, training, requests
Schematic illustration of a takeover. Simplified example.
We work for
- Start-ups
- SaaS providers
- Platforms
- E-commerce
- SMEs
Key points at a glance
- An external data protection officer supports the data protection function on an ongoing basis, prioritises risks and remains the point of contact for the company, data subjects and the supervisory authority.
- Whether there is an obligation to designate one is determined by Art. 37 GDPR and § 38 BDSG.
- Responsibility under data protection law remains with the company.
- The DPO advises, monitors and acts as a point of contact.
- ITMR combines the DPO function with IT law, data law, SaaS, platforms, AI and compliance.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- SaaS
- Software as a Service. Software used over the internet rather than installed.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
- DSFA
- Data protection impact assessment under Art. 35 GDPR. It assesses the risks of a processing operation before it starts.
- VVT
- Record of processing activities under Art. 30 GDPR. It lists which data is processed for which purpose.
Designation obligation
When is a data protection officer mandatory?
Many companies have a duty to designate a data protection officer without knowing it. What matters is the number of people who work with data and the type of processing.
There is an obligation if, as a rule, at least 20 people are constantly involved in the automated processing of personal data. Everyone who regularly works at a computer with customer, personnel or email data counts, including part-time staff, trainees and freelancers.
Smaller companies also need a DPO if a data protection impact assessment is required (Art. 35 GDPR), if they process data commercially for transfer or for market and opinion research, if their core activity consists of large-scale, systematic monitoring of individuals or if they process special categories of data such as health data on a large scale (Art. 37 GDPR).
The DPO's contact details must be published, for example in the privacy policy. They must also be communicated to the competent supervisory authority (Art. 37(7) GDPR). We take care of these steps in the start phase.
Not sure whether the obligation applies? Briefly tell us your team size and activity. We will assess it before any costs arise.
Starting point
When do companies ask for an external DPO?
The need shows in how the company develops.
Growth, the tool landscape, customer requirements or internal responsibilities show that data protection needs an independent function.
The function must be permanently reachable, prioritise risks and make decisions documentable. We assess in advance whether an external data protection officer is necessary or sensible for you.
An external DPO is more than a name in the legal notice or an email address for data subjects. The role should ensure that data protection issues are recognised early, assessed professionally and handled in a risk-oriented way.
Besides the formal designation, what counts is whether the function can be reached internally, gets access to relevant information and can work independently.
For the general classification of GDPR compliance, regulatory proceedings, data breaches, access requests or damages, the page on data protection law for companies remains the right starting point. This page focuses on outsourcing, takeover and ongoing steering of the DPO function.
- For whom
- Companies with growing data protection responsibility
- Legal basis
- Art. 37 to 39 GDPR, § 38 BDSG
- Service
- Takeover and ongoing DPO function
- Responsibility
- remains with the company
Clarify the designation obligation. The company is growing, processes personal data in several areas or reaches an organisational size at which the DPO question should no longer remain open.
Relieve the internal role. An internal data protection officer is overloaded, not reliably integrated or in a conflict of interest because of operational proximity.
Make evidence robust. Customers, investors, tenders, the supervisory authority or management ask for data protection documents that match the actual processing.
Organise digital processes. Website, SaaS, platform, CRM, HR tools, newsletter, cloud services and service provider chains have grown and need a consistent data protection line.
Secure the ability to respond. Access requests, erasure questions, data breaches or contact with authorities show whether responsibilities and documentation work in an emergency.
Run data protection on an ongoing basis. Instead of a one-off text correction, the organisation needs an external function that assesses, bundles and prioritises data protection questions on a recurring basis.
Quick assessment
A short description is enough. We will respond on working days within 24 hours.
Process
How does ITMR take on the DPO function?
In three steps from need to an ongoing data protection function.
01
Assess your needs We review the obligation, starting point, data processing, company structure and the specific need for external data protection support.
02
Take on the function We structure the designation, contact details, notification to the supervisory authority, internal responsibilities and the first priorities.
03
Ongoing steering We support audits, documentation, training, data subject requests, DPIA topics, service provider chains and communication with authorities in a risk-oriented way.
From designation to function
- 1
Disclose the starting point We record the company structure, systems, data categories, service providers, departments, existing documents, open risks and the reason for the enquiry.
- 2
Clarify obligation and roles We review whether there is an obligation to designate, how the DPO function should be integrated organisationally and which internal interfaces are needed.
- 3
Set priorities Not every data protection gap is equally urgent. Priority goes to points that affect contact with authorities, data subject rights, customer approvals, audit readiness or liability.
- 4
Establish an ongoing line After the takeover, the focus is on reachable communication, traceable documentation, internal responsibilities and a structure that departments can use.
How long does it take? Most work steps are completed within a few working days. How quickly it goes depends on the scope and on your feedback. Do you have a fixed date, such as a launch? Tell us when you send your enquiry and we will plan for it.
Service
What does ITMR provide as external DPO?
Service package: external data protection officer
Start and takeover phase Review of obligation, need and allocation of roles. Structuring of designation and contact details. Initial survey of systems, data flows, service providers and responsibilities. Prioritisation of the first data protection work areas.
Ongoing DPO function Advice to management and departments. Monitoring of central data protection processes and documentation. Support with access, erasure and objection requests. Point of contact for supervisory authorities.
Documentation and evidence Assessment of the record of processing, privacy notices, DPAs, TOMs and deletion concept. Comparison between documents and actual processing. Notes on gaps and workable corrections. Support with audit, customer and management requirements.
Risk topics and escalation Involvement in data protection impact assessments and high-risk projects. Support with data breaches and notification questions. Assessment of tool changes, cloud services and international data flows. Handover to specialist mandates in disputes, incidents or contract questions.
- For whom
- Companies, start-ups, platforms, SaaS, e-commerce
- First response
- on working days within 24 hours
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Operational implementation in the company. Court proceedings only as a separate service, on request.
Who delivers what and who decides
- Company size and sector
- Systems and service providers used
- Existing data protection documents
- Current reason
- Designation as external DPO
- Advice and monitoring
- Point of contact for data subjects and the authority
- Prioritisation of risks
- Your management, on measures
- The supervisory authority, in proceedings
How does instructing us work?
- 1
Initial assessment You describe your starting point via the form. We assess your DPO needs. Initial contact is free of charge.
- 2
Offer Before we start, we tell you the scope, takeover plan and costs transparently.
- 3
Court steps separately Court proceedings, representation in regulatory proceedings and specialist mandates are agreed separately.
Tasks
What are the tasks of an external data protection officer?
The tasks are set out in Art. 39 GDPR. In everyday practice this means:
- Advising management and staff on data protection obligations.
- Monitoring whether processes, tools and contracts comply with the GDPR.
- Advising on data protection impact assessments.
- Supporting training and awareness.
- Acting as a point of contact for data subjects, for example for access or erasure requests.
- Cooperating with the supervisory authority and acting as its point of contact.
- Advising on data breaches.
- Prioritising by risk: what comes first, what later.
The DPO does not automatically draw up the record of processing, contracts or every DPIA. These are obligations of the company, with which we support you on request, for example with the record of processing activities, with the data processing agreement or with the data protection impact assessment.
What requirements must the DPO meet?
The DPO needs expert knowledge of data protection law and practice (Art. 37(5) GDPR). The DPO must be able to work independently and must not have a conflict of interest (Art. 38 GDPR). Managing directors, heads of IT or heads of HR are therefore usually ruled out.
Comparison
Internal or external data protection officer?
An internal DPO can work if expertise, independence, time budget and position are secured. If the person also has operational responsibility for IT, HR, marketing, sales or product, conflicts of interest and unclear reporting lines are likely.
| Criterion | Internal DPO | External DPO |
|---|---|---|
| Independence | Can work if there is no operational proximity to the decisions under review. | Stronger if internal roles create conflicts of interest or hierarchical pressure. |
| Expertise | Must be built up, maintained and kept available in the company. | Comes immediately with data protection practice, documentation experience and familiarity with authorities. |
| Resources | Ties up internal capacity and competes with day-to-day tasks. | Relieves internal teams and creates a clear external point of contact. |
| Digital complexity | Demanding when tools, SaaS, platforms, cloud and international service providers come together. | Fits particularly well when data protection, IT law, contracts and digital business models need to be assessed together. |
| Escalation | Depends heavily on internal position, experience and access to information. | Moves faster into specialist legal support in regulatory, access request, incident or audit situations. |
Costs
Costs of an external DPO: what drives them?
Costs depend on the actual effort. They depend less on the number of employees than on how much data you process and how sensitive it is.
Number of locations, companies and departments.
For example health, employee or children's data.
Number of tools, cloud and AI services, service providers and third-country transfers.
Do records of processing, DPAs, TOMs and policies already exist, or does much have to be built first?
Data subject requests, customer audits, tenders, incidents.
Regular meetings, training, project support.
A start phase with a stocktake followed by ongoing support is usual. After the initial conversation you receive an offer showing what is included and how additional effort is billed. We will inform you expressly before any costs arise.
When comparing with an internal DPO, you should factor in training, working time and the special protection against dismissal of the internal DPO (§ 38(2) in conjunction with § 6(4) BDSG).
Liability
Who is liable: the company or the data protection officer?
The company as controller is primarily liable for data protection breaches. This applies to damages under Art. 82 GDPR (more on GDPR damages) as well as to fines under Art. 83 GDPR. Anyone who fails to designate a data protection officer despite being obliged to do so risks a fine for that reason alone.
The DPO advises and monitors but does not decide. The DPO is only liable to the company for breaching their own tasks. For an external DPO, the contract governs this; lawyers also carry professional liability insurance.
Sectors
For which sectors do we act as external DPO?
SaaS and software Processing on behalf of customers, sub-processors, customer audits, AI functions.
E-commerce and platforms Tracking, payment services, marketing and many data subject requests.
Health and life sciences Special categories of data, data protection impact assessments, research.
Agencies and marketing Campaign tracking, customer data, joint controllership.
SMEs and industry Personnel data, video surveillance, group structures, third-country transfers.
Start-ups A lean set-up and robust documents for investor due diligence.
Alternatives
When is another data protection service a better fit?
An audit reviews the current state. A set-up builds structures. The external DPO supports the function on an ongoing basis. For isolated individual topics, a specialist page is more relevant.
Review of the existing state of data protection before priorities and measures are set.
Go-live, relaunch, product release or new data protection structures.
Service provider chains, SaaS, cloud, hosting or subcontractors as a bottleneck.
The documentation of processing activities is built up or sharpened in isolation.
Individual processing operations are assessed in more depth because of risk, sensitivity or monitoring.
Tracking, consent banner, privacy policy and website tools are the focus.
Legal framework
What must the DPO function deliver?
The DPO function does not replace the company's responsibility. Management, controllers and departments must enable data protection decisions, provide information and implement measures.
The DPO informs, advises, monitors, works towards compliance and acts as a point of contact. Operational decisions remain with the controller or processor. Our simulator for GDPR role allocation allows a first clarification of the roles between you and your service providers.
The obligation to designate can arise from Art. 37 GDPR and additionally from § 38 BDSG. For non-public bodies in Germany, what matters is whether, as a rule, at least 20 people are constantly involved in the automated processing of personal data.
Art. 38 GDPR requires early involvement, resources, independence and a conflict-free allocation of tasks. Art. 39 GDPR lists informing, advising, monitoring, DPIA advice and cooperation with the supervisory authority. Breaches of obligations under Art. 25 to 39 GDPR can lead to fines under Art. 83 GDPR.
- GDPR on EUR-Lex Art. 37 to 39 and Art. 83 GDPR.
- § 38 BDSG Designation in non-public bodies.
- EDPB guidelines on the DPO Guidelines on the data protection officer.
Limits
What remains with the company?
Clear roles keep the DPO function effective.
- 1
Responsibility remains Responsibility under data protection law remains with the controller or processor.
- 2
Internal implementation You anchor measures, resources and business decisions in the company.
- 3
Specialist mandates separately Audit, DPA, record of processing or DPIA can become a separate mandate, depending on depth.
- 4
Disputes separately Court proceedings and contentious regulatory proceedings are agreed separately.
Why a DPO function fails
- The function exists only on paper and is not involved in projects.
- The internal DPO also makes operational decisions on the processing they are supposed to monitor.
- Documents describe processing that no longer takes place in that form.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“I had already engaged Mr Bohne some time ago on a data protection matter and was very satisfied. Now my company became involved in a copyright dispute. Mr Bohne handled this matter quickly, reliably and professionally as well …” (translated from German)
“Mr Bohne gave me excellent advice on data protection for my website. Professional, friendly and tailor-made solutions. Any time again! Highly recommended!” (translated from German)
“Mr Bohne is an excellent lawyer. He really took his time, listened carefully and gave me clear recommendations on how to set up my app in Germany in line with the GDPR, including tips on typical pitfalls. …” (translated from German)
FAQ
What do companies ask about the external DPO?
When must a company designate a DPO?
An obligation can arise from Art. 37 GDPR and additionally from § 38 BDSG. For non-public bodies in Germany, what matters is whether, as a rule, at least 20 people are constantly involved in the automated processing of personal data or whether certain high-risk processing takes place. The specific assessment depends on the company and the processing.
Is an external DPO better than an internal one?
Not automatically. What matters is expertise, independence, availability, resources and freedom from conflicts. An external solution becomes attractive if there is no suitable person internally, conflicts of interest are likely or data protection is linked with IT, SaaS, platforms, marketing, HR and service provider chains.
Does the company remain responsible if ITMR becomes the external DPO?
Yes. Responsibility remains with the controller or processor. The DPO advises, monitors, raises awareness, supports risk questions and acts as a point of contact. Measures, resources and business decisions remain anchored in the company.
What should be prepared before the enquiry?
Helpful are company size, sector, locations, the number of people working with personal data, systems used, existing documents, current triggers and known weaknesses. Complete documentation is not required for the first assessment.
Can ITMR replace an existing DPO?
Yes, if the replacement is prepared properly in legal and organisational terms. Important are the handover, contact details, notification to the authority, internal communication, open cases and the question of which risks to review first during the change.
Does an external DPO make sense even without an obligation?
Yes, if data processing is business-critical, customers ask for evidence, sensitive processes exist or data protection cannot be managed reliably internally. Then it is about governance, demonstrable compliance and the ability to act.
Does the external DPO also handle audits, DPAs, records of processing and DPIAs?
The DPO function can initiate, support and prioritise such topics. Depending on depth, they become a separate mandate, such as a data protection audit, a DPA, a records of processing project or a data protection impact assessment.
How quickly can the DPO function be taken over?
That depends on the starting point, documents, structure and open risks. A short description is enough for the first assessment. We then clarify whether a designation, an audit, a transition plan or a closer review makes sense first.
What does an external data protection officer cost?
That depends on data types, systems, starting point and ongoing volume. After the initial conversation you receive an offer. Costs only arise once you agree.
Can the managing director be the data protection officer?
As a rule, no. Whoever decides on the processing cannot independently monitor themselves.
What happens if no data protection officer is designated?
The supervisory authority can impose a fine. Often the structure to handle data breaches and requests in time is also missing.
Does the data protection officer have to be on site?
No. The DPO must be reachable and have access to the necessary information. The work can largely be done digitally.
Next step
Set up a robust external data protection function
Can data protection in your company no longer be run on the side? Then a clear line counts: review obligation and need, set up the function, prioritise risks and make communication between management, departments, data subjects and the authority manageable.
Useful for your enquiry
- Company size and sector
- Number of people with data access
- Systems used
- Current reason
You can also submit documents after our first response.
Have your DPO needs assessed
For companies that want to outsource or change their data protection officer function.
Describe your starting point, clarify your DPO needs.
Related services
Data protection law for companies Core area of data protection.External legal department Ongoing legal needs.Data protection audit Review the current state.Data protection training Train your teams.EU representative under Art. 27 GDPR For companies without an EU seat.Service packages All packages.