Question 1

Which companies must appoint a data protection officer?

Accepted Answer

According to the requirements of the GDPR and specified by the BDSG, companies must appoint a data protection officer if at least 20 people regularly process personal data automatically, e.g. using a PC, tablet or smartphone. This is often the case in the IT or HR department, but can also apply to all other departments in your company. The obligation to appoint a data protection officer is independent of the number of persons if the company processes particularly sensitive personal data. This is the case, for example, with health data or data on political attitudes. Or if the core task of the company's activities lies in the collection, processing, utilisation or transfer of personal data. Companies must also appoint a data protection officer if processing operations are carried out that require a data protection impact assessment in accordance with Art. 35 GDPR (e.g. in the case of video surveillance) Please note: Even if your company is not obliged to appoint a data protection officer, you must still comply with and fulfil all the requirements of the GDPR.

Question 2

Why is an external data protection officer better than an internal, company data protection officer?

Accepted Answer

With an external data protection officer from MKM, your company receives experts in data protection with years of professional experience. All of our consultants are lawyers and business lawyers with a high affinity for IT and technology topics and a wealth of experience from various industries, sectors and projects. MKM attaches great importance to regular training and further education for its consultants.

This means that you do not have to worry about the training and further education of an external data protection officer - unlike with a company data protection officer. Company data protection officers often only perform this important function for up to 10 to 15% of their working time. This is time that is often lacking elsewhere and is far from sufficient for the large number of topics and issues for the company data protection officer.

Question 3

Is an external data protection officer liable for breaches?

Accepted Answer

An external data protection officer is liable for their advice. This means that in the event of incorrect advice under data protection law, they must take responsibility. Reputable consultants take out liability insurance for this purpose. At MKM, this amounts to EUR 10 million. However, the data protection officer is not liable for any failure by the company to implement its advice. This liability always remains with the company and its executive bodies. With an external data protection officer, you therefore receive advice at the highest level.

Question 4

Time required: Does the person supporting the external data protection officer have enough time for their core tasks?

Accepted Answer

The time required for this activity cannot be standardised. It depends, among other things, on the size of the company, the amount of data processed and the IT structure.

However, the external data protection officer will provide an individual introduction in order to be able to manage the time required in a targeted manner.

external
data protection officer

A data protection solution that convinces

External data protection officer - is it worth it?

Yes, especially for small companies

Data protection package for €249

Inklusive Leistungen

Advantages of our model

These and many more customers trust us

External data protection provider vs. internal solution: a price comparison

Collaboration with data protection experts

Many years of experience

Highly qualified team

Cross-industry consulting

Your contact persons

FAQ on the data protection officer