Do you need a data protection officer?

Often sooner than you think. And even without an obligation it pays off once clients, corporate partners or tenders ask about data protection.
From 20 people

As soon as at least 20 people are regularly involved in the automated processing of personal data, a DPO is mandatory in Germany (§ 38 BDSG).

Sensitive data & risk

Regardless of size: for health or financial data, large-scale monitoring or processing that requires a data protection impact assessment.

Voluntary, but expected

Enterprise clients and public buyers increasingly require a named DPO before they share data or award contracts.

What we take care of

A fixed scope instead of timesheets. You know where you stand, and we are there when it matters.
  1. 01 Appointment & notification We are named as your external DPO and notify the competent supervisory authority.
  2. 02 Records & TOMs Records of processing activities and technical and organisational measures: set up, maintained, audit-ready.
  3. 03 Contracts & vendors Review of data processing agreements, third-country transfers and new tools before they go live.
  4. 04 Impact assessments DPIAs for high-risk processing, properly documented and with concrete measures.
  5. 05 AI & EU AI Act Assess the use of AI models for data protection compliance, from prompt to hosting.
  6. 06 Training & awareness Short, practical training for your team instead of endless slide decks.
  7. 07 Data subject rights Answer access, erasure and objection requests on time and traceably.
  8. 08 Breaches & audits Fast support during incidents including the 72-hour notification, and a contact for audits.

Data protection from people who build software

Most data protection officers come from law. We come from engineering and know the law.
Technically grounded

We read architectures, data flows and contracts alike. Recommendations your engineering team can actually implement.

AI without the headache

We build AI systems ourselves and know what matters for models, hosting and the EU AI Act.

Pragmatic, not blocking

Data protection should enable projects. We look for the path that is compliant and still gets you there.

How we start

  1. 1 Initial call 30 minutes: where do you stand, what is mandatory, what makes sense?
  2. 2 Assessment We review processing activities, vendors and documentation and show the gaps.
  3. 3 Appointment Official appointment as external DPO and notification of the supervisory authority.
  4. 4 Ongoing support A dedicated contact, regular reviews and fast help during incidents.

Your contact

Benjamin Konopka is managing director of alm and has worked in data protection for more than ten years. He has already provided his expertise to numerous companies and, as a former frontend developer and certified AI innovation manager, brings technology and law together.
View Benjamin's profile →

Frequently asked questions

What does an external data protection officer cost?

That depends on the size, industry and data situation of your company. After the initial call you receive a fixed monthly offer without hidden hour packages.

Internal or external, which is better?

An internal DPO needs expertise and training and enjoys special protection against dismissal. An external DPO brings the experience from day one, is independent and can be terminated flexibly.

How quickly can you start?

Usually within a few days of the initial call. In case of an acute data breach we help immediately.

Do you also support companies alm does not build software for?

Yes. The data protection officer role is a standalone service and not tied to a development project.

Let's talk about your data protection.

Whether mandatory from 20 employees or voluntary for more certainty: in a short call we clarify what your company needs.

Request a data protection officer