External data protection officer: what it really costs

In brief

• Market price: Small companies typically pay €150 to €300 per month for an external data protection officer, larger ones €500 to €2,000 (figures from the professional association BvD). Public price lists for businesses with fewer than 20 employees usually start at around €150.
• The monthly price is deceptive: What matters is the contract term, the scope of services and additional costs. Two offers with the same monthly price can differ by thousands of euros over the contract term.
• An internal DPO is rarely cheaper: Initial training (around €1,650 to €2,400), regular further training and working time quickly add up to €2,000 to €6,000 a year. On top of that come special protection against dismissal and the risk of conflicts of interest.
• Check first whether you need one at all: In Germany, the obligation applies from 20 people who permanently work with personal data, or in special cases. The abolition of this rule has been announced but not yet adopted.
• With or without a DPO: The obligations under the GDPR stay the same. In companies, the greatest effort is caused by the documentation anyway, not by the data protection officer.

Do you need a data protection officer at all?

Before you compare prices, clarify whether the obligation applies to you. In Germany, you must designate a data protection officer if one of the following cases applies:

• As a rule, at least 20 people are permanently engaged in the automated processing of personal data (§ 38(1) of the German Federal Data Protection Act, BDSG). The former threshold of 10 people has not applied since 2019.
• You carry out processing operations that require a data protection impact assessment, or you process data on a commercial basis for the purpose of transfer or for market and opinion research. In that case the obligation applies regardless of headcount.
• Your core activity consists of the extensive processing of particularly sensitive data, such as health data, or the extensive, systematic monitoring of people (Art. 37 GDPR).

Whether the obligation applies to you is clarified by the obligation check on the external data protection officer page. Even without an obligation, you can designate a DPO voluntarily (Art. 37(4) GDPR). The same rules on position and tasks then apply to them.

What an external data protection officer costs

There is no independent survey of DPO prices. The most frequently cited guide comes from the professional association of data protection officers in Germany (Berufsverband der Datenschutzbeauftragten Deutschlands, BvD), though without a published methodology. We cross-checked it against providers’ public price lists in October 2026:

Almost all prices are net prices. If, as a small business under the VAT small business scheme (Kleinunternehmer), you do not deduct input VAT, you pay the VAT on top.

How billing works: The usual model is a monthly flat fee, staggered by the number of employees. Billing by the hour is less common, and special services such as an on-site audit are often charged at daily rates. A flat fee is predictable, but it is only worth as much as the services it covers.

What drives the price: The number of employees and locations, sensitive data (health, children, employee data on a large scale), many service providers and tools in use, on-site appointments instead of remote ones, the response times you want and the state of your documentation at the outset.

What the price should include

The GDPR sets out the tasks of the data protection officer (Art. 39). They belong in every flat fee:

• Advising: Informing and advising management and employees on their data protection obligations.
• Monitoring: Checking whether data protection requirements and internal policies are complied with, including awareness-raising and training for employees.
• Supporting the impact assessment: Advice when a data protection impact assessment is required.
• Acting as the contact point: for the supervisory authority and for data subjects who have questions about their data (Art. 38(4) GDPR).

Important to know: a data protection officer advises and monitors, but does not have to write your documents. The company itself creates the record of processing activities, TOM, privacy policy and data processing agreements. Many offers include this work anyway, others charge extra for it. So ask exactly what is included:

What an internal data protection officer costs

Making one of your own employees the DPO seems cheaper because no invoice arrives. The costs lie in initial training, further training and working time:

• Initial training: A course with a final examination costs around €1,650 to €2,400, for example €1,649 plus VAT for three days at TÜV Saarland or €2,400 for five days at the IHK-Akademie München. The law does not require a certificate, but it does require demonstrable expert knowledge (Art. 37(5) GDPR).
• Further training: The company must provide the DPO with the resources to maintain their expert knowledge (Art. 38(2) GDPR) and bear the costs of further training. To maintain a certificate, at DEKRA for example, you need 24 hours of further training within three years plus a fee. That comes to roughly €600 per year.
• Working time: No authority specifies how much time the role requires. The following calculation therefore assumes three scenarios.

The basis is the median gross annual earnings of a full-time employee in Germany, €54,066 in 2025 (Federal Statistical Office). Employer social security contributions come on top, as does the initial training in the first year. For comparison: based on the BvD range, an external DPO costs €1,800 to €3,600 a year.

Internal or external: the comparison

An internal DPO is worthwhile above all for larger companies with their own legal department or with someone who looks after data protection as their main job anyway. For companies with 20 to 50 employees, an external DPO is in most cases the cheaper and safer solution.

How to recognise a good offer

• A named person: You get a specific contact person with proven expert knowledge, not just a team inbox.
• Clear scope of services: The offer lists what the flat fee covers and what costs extra, including the hourly quota and response time.
• Fair contract term: A longer term strengthens the DPO’s independence, which supervisory authorities also recommend. Because of the planned reform, however, the contract should include a special right of termination in case the designation obligation is abolished.
• Professional indemnity insurance: External DPOs are liable in a different way from employees; professional indemnity insurance makes sense, as the Baden-Württemberg data protection authority emphasises.
• Notification included: The contact details of the DPO must be communicated to the supervisory authority and stated in the privacy policy (Art. 37(7) GDPR). A good offer takes care of this together with you.

The most common mistakes

• Comparing only the monthly price. Calculate the price times the term plus the additional services you can expect. Only then can offers be compared.
• Mistaking software for a DPO. A tool can create documents and organise obligations, but it does not replace a designated person with expert knowledge where a designation obligation exists.
• Designating management or the head of IT internally. Anyone who decides on the purposes and means of data processing cannot monitor themselves.
• Designating but not notifying. The notification to the supervisory authority is part of the obligation; you can find the right notification portal via the overview external DPO by city (in German).
• Signing a contract with a long term and no way out. Especially now, when the obligation could cease to apply to many companies, a special right of termination is worth a lot.
• Assuming there is less to do without a DPO. In a Bitkom survey of 603 companies, 73% named the documentation obligations as the greatest burden, and only 25% named the designation of a data protection officer.

External DPO with Dieter: what is included

Dieter combines the external data protection officer with the software that does most of the work. As a result, the support costs less, and the documentation stays up to date on an ongoing basis instead of once a year.

• TÜV-certified external DPO as your fixed contact person, designation in three guided steps and notification to the supervisory authority directly from the product.
• All mandatory documents: The record of processing activities, TOM, data processing agreements and privacy policy are created via questionnaire and update themselves when something changes.
• Training including records for your employees, with automatic reminders.
• Website scans that detect new trackers and third-party providers on your website.

If you do not need a DPO, you can cover the GDPR obligations with Dieter even without one. The free GDPR check-up shows you where you stand.

Conclusion

An external data protection officer typically costs small companies €150 to €300 a month, and an internal one hardly less once initial training, further training and working time are factored in. The difference lies in the scope of services, the contract term and additional costs. First check whether you need a DPO at all, and then compare offers over the entire term. And whatever the outcome of the reform: the real work lies in the documentation. Those who have it under control end up paying the least for data protection.