Question 1

When do I need a data protection officer (DPO)?

Accepted Answer

Appointment of a DPO is legally required if your business employs at least 20 people who regularly process personal data. Part-time staff, temps, and interns count fully when measuring headcount.

Appointment may also be mandatory for businesses whose nature, scope, and/or purposes require large-scale, regular, systematic monitoring of data subjects, or where core activities consist of large-scale processing of special category data (Art. 9 GDPR).

We analyse whether your business is affected at the start in a free data protection check-up. You can start it immediately and test Dieter’s features.

Question 2

What if I do not need a DPO?

Accepted Answer

All businesses must meet GDPR requirements. That applies regardless of headcount – including sole traders and solo self-employed professionals.

They must comply with general data protection principles (lawfulness, transparency, purpose limitation, data minimisation, among others), inform data subjects about processing, and implement technical and organisational measures to protect personal data. Smaller businesses are also required to maintain a record of processing activities, a deletion concept, and processes for handling personal data breaches, and more.

With Dieter, you no longer need to worry. We take care of everything you need to meet your legal obligations.

Question 3

External or internal DPO?

Accepted Answer

Appointing an internal DPO has the advantage that they often know the business well and have direct access to information. Effective paths must still be found to turn that information into legally required measures. There is also a dependency between employee and employer (regardless of separate dismissal protection), which can quickly create conflicts of interest affecting both core work and DPO duties. The employer must also cover short- or long-term absences internally.

Appointing an external DPO avoids those drawbacks. A time-limited contract, communication on equal footing, and the option to change provider are possible. A good DPO should balance business needs with legal obligations; professional external DPOs bring the experience needed for successful advice.

Question 4

What do appointment and notification of a DPO mean?

Accepted Answer

Appointing a data protection officer is a legal act comparable to designation. Through appointment the DPO is officially installed and assumes rights and duties. To ensure the organisation is adequately protected, required formalities must be observed and appointment carried out properly.

The DPO must be notified to the competent data protection supervisory authority, which monitors compliance and acts as contact for data protection matters. Ensure notification is proper and contains all required information.

Question 5

Sharing data requires contractual arrangements

Accepted Answer

Almost all German businesses use services from companies (Google, Microsoft, Meta, Amazon, etc.) that require an international data protection agreement (SCC/JC). Digital service providers also necessarily receive personal data from their clients to deliver the service. In those cases, you must assess whether and with whom data processing agreements (DPAs) are required. Dieter handles that assessment and always provides the right contract.

Question 6

Cease-and-desist letters are on the rise

Accepted Answer

Cease-and-desist letters for GDPR violations have increased steadily in recent years. A prominent example is the wave of letters over unlawful use of Google Fonts in summer 2022. Although some of those letters were not lawful, they were based on a Munich Regional Court decision from January 2022. In late 2022, the Court of Justice of the EU also ruled that consumer associations may generally send cease-and-desist letters for GDPR breaches. These and other court decisions triggered further waves. EU-wide GDPR fines reached a new record of €1.2 billion in 2024. Any business that neglects its legal duties can be affected.

Question 7

A legally compliant website is essential

Accepted Answer

A GDPR-compliant website is the first step to protect yourself effectively against cease-and-desist letters. In 2022 alone, there were countless letters over unlawful use of Google Fonts – and pressure continues to grow. Since May 2024, the German Digital Services Act (DDG) has also placed further requirements on website operators. Dieter handles your data protection needs and can create your Impressum as well.

Question 8

More fines for small businesses

Accepted Answer

Data protection authorities have begun conducting inspections without a specific trigger. For companies with fewer than 20 employees, the statistical risk of being affected is over 10:1.

Question 9

Cybercrime in Germany is growing sharply

Accepted Answer

According to a Bitkom study, 87% of German companies were recently victims of a cyber attack. Total damage to the German economy exceeds €289 billion per year – and rising. Implementing mandatory technical and organisational measures (TOM) significantly reduces the risk of being affected.

Question 10

Personal data is a form of currency

Accepted Answer

Since 2022, personal data has been legally treated in some respects like a currency – and with the Data Act in force since 2024, data as an economic asset carries even more weight. Awareness is growing. This data should be as secure as a bank account – and implementing the GDPR helps achieve that.

Question 11

Poor data protection costs customers and business partners

Accepted Answer

More than two thirds of participants in a consumer data and privacy study (commissioned by McKinsey & Company) said they would no longer be customers of – or would stop working with – a company that does not protect their data or shares it without a legal basis. Responsible handling of personal data and meeting legal obligations is a clear competitive advantage.

Question 12

The right to data protection is a fundamental right

Accepted Answer

Everyone has the right to decide which personal (and therefore highly private) data about them is collected, stored, and used. It also helps prevent misuse, fraud, and discrimination. Data protection protects privacy, identity, and freedom – and is essential for a democratic society. Respecting it should be a matter of course for every business.

Question 13

An external DPO is not mandatory: Dieter Datenschutz as an all-round data protection solution

Accepted Answer

If a business is not legally required to appoint a DPO, there are two paths: an external DPO handles data protection tasks and relieves the core team – but is costly and often not worthwhile for small businesses. Alternatively, data protection tasks can be distributed in the existing team – in which case modern software is advisable. Dieter Datenschutz offers many features for that.

Question 14

Dieter Datenschutz convinces businesses across industries

Accepted Answer

With Dieter Datenschutz an external DPO is often unnecessary. The cost-efficient solution is easy to use, digital everywhere, and always available. We now serve more than 5,000 satisfied users and have helped create over 15,000 legal documents. Over 500 integrated services support simple, secure use – so an external DPO is often no longer needed.

Question 15

Dieter Datenschutz is the reliable solution for small businesses

Accepted Answer

We understand the challenges the GDPR creates especially for small businesses and solo self-employed professionals and built Dieter Datenschutz as a convincing answer. From the start we focused on software that is easy to use yet very reliable. Want to learn more? Contact us – or test Dieter Datenschutz and its features directly.

External data protection officer

External data protection officer in a few steps

Essentials: external data protection officer

Appoint a TÜV-certified external DPO directly via Dieter

Connect an external DPO with Dieter

Ein Blick in unsere All-in-One Datenschutz Software

Datenschutzerklärung mit ein paar Klicks erstellt

Frequently asked questions about external DPOs

What our
customers say

"Data protection can be this simple!"

"A huge relief when starting out as self-employed!"

"The perfect solution for data protection!"

"Outstanding service with direct 1:1 support"

"Dieter is simply brilliant—from the questionnaire style to support."

"A wonderful tool for all data protection needs"

Die Menschen hinter Dieter

Schützen Sie sich jetzt und aktiv

Externer Datenschutzbeauftragter: Pflicht sauber prüfen, Entscheidungen dokumentieren

Bestellung, Meldung und operative Zusammenarbeit aus einem Prozess

Externer DSB als Verstärker, nicht als Ersatz interner Verantwortlichkeit

Kostenloser Check-up

Individuelle Anforderungen?

KI nutzen. Rechtssicher.