DPO requirement: will the 20-person rule be scrapped?

In brief

• Announced, not passed: On 4 December 2025, the federal and state governments agreed that the federal government will introduce a bill by 31 December 2026 repealing the German designation obligation in § 38(1) of the Federal Data Protection Act (BDSG). The 31 December date is the deadline for the bill, not the end of the obligation.
• There is no bill yet. Until an amendment has been published in the Federal Law Gazette, § 38 BDSG continues to apply unchanged.
• If you need a data protection officer today, you still need one. Removing your DPO or giving notice speculatively is risky.
• If § 38(1) goes, Art. 37 GDPR remains: If you process health data on a large scale or systematically monitor people, you will still have to designate a DPO, however big your team is.
• All other obligations remain: privacy policy, record of processing activities, technical and organisational measures (TOM), data processing agreements, data subject rights, reporting of data breaches. Without a DPO, all that is missing is the person who keeps an eye on them.

What has happened?

Behind the headline that the obligation to have a data protection officer is going away lie two political decisions:

• 4 December 2025, Federal Modernisation Agenda: The Federal Chancellor and the heads of government of the federal states adopted a long list of measures to reduce burdens. Under margin number 160, it states: “The federal government will introduce a repeal of § 38(1) BDSG by 31 December 2026, thereby limiting the obligation to appoint data protection officers in the private sector to the rule in Art. 37 GDPR.”
• 2 July 2026, coalition committee: In the reform package “A programme for recovery and employment”, the coalition confirmed the direction: “In smaller and medium-sized companies, we want to reduce the number of company data protection officers.” Under item 26, it also announced plans to abolish other officers in companies whose appointment is not based on EU requirements. Compliance with the requirements would then be “made more the responsibility of companies, accompanied by high penalties for infringements”.

Since then, things have gone quiet. To date, the federal government has not published a bill repealing § 38 BDSG. Beware of mix-ups: the bill amending the BDSG that has been pending in the German Bundestag since August (printed paper 21/7732) comes from the Federal Council (Bundesrat), which represents the federal states, and governs the organisation of data protection supervision. The DPO requirement does not appear in it.

There is also opposition. The German Data Protection Conference (DSK), made up of the supervisory authorities, considers abolishing company data protection officers “the wrong path”, and the German professional association of data protection officers (BvD) is calling for their role to be strengthened rather than abolished.

What does this mean for you?

For most small businesses, nothing changes today. What might change later depends on why you need a data protection officer:

What “large scale” means is not defined in figures. In their guidelines on data protection officers, the European data protection authorities give examples such as the processing of patient data in a hospital, credit scoring or behavioural advertising. An individual medical practice or law firm, on the other hand, is generally not regarded there as large-scale processing.

Companies with an internal data protection officer should pay particular attention. Their special protection against removal and dismissal only applies as long as the designation is mandatory (§ 38(2) in conjunction with § 6(4) BDSG). Only the bill will show how a new law deals with existing designations.

What to do now, and what not to do

What you should do:

1. 1Check the obligation as it applies today. Count how many people work permanently with personal data, including part-time staff. You will find the quick obligation check on the external data protection officer page.
2. 2Keep the designation and notification up to date. If you are subject to the designation obligation, you must communicate the DPO’s contact details to the supervisory authority and state them in your privacy policy (Art. 37(7) GDPR). The overview external DPO by city (in German) shows you the right notification portal.
3. 3Look at your DPO contract. How long does it run, does it renew automatically, how long is the notice period? If you are signing a new contract now, look for a short term or a special right of termination in case the obligation ceases to apply. How to switch without a gap is explained in the guide Switching your data protection officer.
4. 4Put your documentation in order. You need an up-to-date record of processing activities and properly described technical and organisational measures with or without a DPO. That is what the supervisory authority asks for first.

What you should not do:

• Removing your DPO or terminating the contract now because “the obligation is going away anyway”. If you are subject to the designation obligation and have no DPO, you are in breach of the GDPR. The range of fines for this extends up to €10 million or 2% of worldwide annual turnover (Art. 83(4) GDPR).
• Believing headlines such as “Obligation ends on 31 December”. What counts is the law in the Federal Law Gazette, not an announcement.
• Scaling back data protection without a DPO. The coalition has expressly announced that it will shift responsibility more strongly onto companies and punish infringements severely. If the DPO goes, the entire responsibility lies with management.

What happens next

Before a repeal takes effect, there has to be a bill, deliberation in the Bundestag and the Bundesrat, and promulgation in the Federal Law Gazette. Even if the bill arrives before the end of 2026, this procedure usually takes several months. The obligation is therefore not expected to cease on 1 January 2027.

Regardless of this, you can designate a data protection officer voluntarily at any time (Art. 37(4) GDPR). The same rules on position and tasks then apply as for a mandatory designation (Art. 38 and 39 GDPR). Many companies keep their DPO even without an obligation, because customers, clients and insurers ask for a person in charge.

With or without the obligation: data protection with Dieter

Dieter is built to work with or without a DPO requirement. You cover the GDPR obligations in every package: privacy policy, record of processing activities, TOM, data processing agreements and processes for data subject requests and data breaches, kept continuously up to date instead of created once.

• Without a designation obligation: With the free GDPR check-up, you can see in a few minutes where your company stands and which documents are missing.
• With a designation obligation or a voluntary DPO: Dieter Premium includes a TÜV-certified external data protection officer, documents, training and website scans, for €99 per month or €79 with annual billing.

Conclusion

Abolishing the German DPO requirement is a political goal, but it is not yet law. Until then, § 38 BDSG applies, and if you need a data protection officer today, you keep them. For small businesses, the real message is a different one: with or without a DPO, the GDPR obligations stay the same, and management bears responsibility for them. If you put your documentation in order now, you are prepared for whatever the outcome of the reform.