What does an external data protection officer cost?

Last updated: 6 October 2026.

Key Takeaways

• External data protection officers in Germany are mostly billed as a monthly retainer. Published prices run from around EUR 33 per month for very small companies on a three-year term to EUR 900 per month in the mid-market; the German Association of Data Protection Officers puts the floor considerably higher, at EUR 100 to 150 (as of September 2026).
• Hourly mandates sit between EUR 100 and EUR 200 per hour. Cortina Consult and Gesellschaft für Datenschutz independently name around EUR 150 as the market average.
• The retainer is rarely the total price. Initial audits, processor agreement reviews, data protection impact assessments, deletion concepts, employee training and on-site meetings are billed separately by many providers.
• An internal DPO usually costs more: EUR 3,000 to 5,000 for the qualification and around EUR 1,500 per year for further training, plus EUR 600 to 1,000 in monthly salary uplift, all per the provider Keyed (as of October 2025). There is no association figure for the share of working time the role takes; the German Association of Data Protection Officers explicitly rejects blanket effort formulas.

Quoted prices for an external data protection officer range from EUR 33 to several hundred euros per month, and the DPO service cost behind those figures is barely comparable from one offer to the next. The reason is that the retainer only covers part of the work. To plan the cost realistically, look at three blocks separately: the ongoing mandate, the one-off build-up work, and the effort that stays with your own team.

What does an external data protection officer cost per month?

The ranges below summarize what German providers publish for external DPO mandates, set against the assessment of the German Association of Data Protection Officers (as of 24 September 2026, net prices).

The German Association of Data Protection Officers sets the floor higher than the cheapest providers do. It names fixed costs from around EUR 100 to 150 per month, an average of EUR 150 to 300 for smaller companies, and EUR 500 to 2,000 for larger firms. Where an offer sits well below that, read the scope of services; the price gap almost always lives in what is included, not in how efficient the provider is.

Sources for the price ranges, each read off the provider's own pages on 24 September 2026: IITR Datenschutz (EUR 32.50 per month up to 20 employees, EUR 290 up to 50 employees), Cortina Consult (from EUR 125 per month), Mprotect365 (from EUR 79 per month, EUR 350 to 900 at 51 to 250 employees), Keyed (EUR 350 to 800 per month) and Gesellschaft für Datenschutz (fixed-price packages from EUR 149 per month, framework agreement above 250 employees).

The lowest entry prices are tied to long contract terms. IITR Datenschutz publishes the same tariff at EUR 32.50 on a three-year term and EUR 49 on a one-year term, a premium of just over 50 percent for the shorter commitment; Gesellschaft für Datenschutz sells its fixed-price packages on a 24-month term. The scope is capped at the entry level too. In a published worked example from Gesellschaft für Datenschutz, a EUR 100 base fee includes ten processing activities and one support hour per month, with every further processing activity and every processor agreement review charged individually. That is a single provider example rather than a market rule; it does show the lever a low base price is built on.

What do audits, qualification and add-on services cost?

Sources, read on 24 September 2026: the hourly corridor comes from Cortina Consult, which states EUR 100 to 200 with a market average of around EUR 150; Gesellschaft für Datenschutz independently names EUR 150 as the average, within an overall span of EUR 40 to 800. Mprotect365 bills ad-hoc support at EUR 100 to 150 per hour. The initial-audit day rates come from Gesellschaft für Datenschutz, the flat fees from Mprotect365. The figures for initial build-up and for the internal DPO come from Keyed (as of October 2025).

Is an internal data protection officer cheaper?

On the numbers, almost never. On top of qualification and further training comes the salary claim for the added responsibility, plus the share of working time that no longer goes to the person's actual role. How large that share is cannot be generalized responsibly. The provider Keyed names 30 to 40 percent of working time; the German Association of Data Protection Officers, by contrast, held in its position paper on effort estimates (March 2020) that undifferentiated rules for calculating effort do not produce realistic results, and points to a single reference value, the Federal Commissioner for Data Protection's recommendation to release a DPO full time from 500 employees onwards. Where the appointment is mandatory, an internal DPO also has special protection against dismissal under Section 38(2) in conjunction with Section 6(4) BDSG, lasting until one year after the role ends. Liability stays with the company either way. In teams under 250 people, the internal route often fails on conflict of interest: management, IT leadership, HR leadership and administrators cannot hold the role.

On the obligation itself: in Germany a data protection officer must be appointed as soon as at least 20 people are constantly engaged in the automated processing of personal data (Section 38(1) sentence 1 BDSG). Irrespective of headcount, sentence 2 also requires an appointment for processing that is subject to a data protection impact assessment, and for the commercial processing of personal data for the purpose of transfer, anonymized transfer, or market or opinion research. The Federal Modernization Agenda of 4 December 2025 states that the federal government will introduce a repeal of Section 38(1) BDSG by 31 December 2026, limiting the appointment duty in the private sector to Art. 37 GDPR. What is promised is the introduction of a bill, not its entry into force; as of 6 October 2026 no draft had been published. An earlier attempt had already failed: the Bundesrat considered a committee recommendation to delete the provision on 22 March 2024, and it did not find a majority; Section 38 BDSG does not appear in the adopted opinion. Until an amendment enters into force, the 20-person threshold applies unchanged. The applicable version is the Federal Data Protection Act as amended on 3 July 2026 (BGBl. 2026 I No. 199); neither of the two 2026 amending acts touched Section 38 BDSG (verified: 6 October 2026). An English translation is published alongside the binding German text.

Why does the monthly retainer say little about total cost?

Hourly billing and modular price lists move cost to where it is hard to plan. A mandate with a EUR 100 base fee can end up more expensive over two years than one at EUR 500 flat, once processing activities, processor agreement reviews, phone calls and the audit are charged individually. Check before you sign:

• How many processing activities and processor agreements are included, and what does each additional one cost?
• Are data subject requests, breach notifications and correspondence with authorities covered?
• Is the initial audit billed separately, and at what day rate?
• Is there a support allowance, and what happens once it is used up?
• What contract term does the entry price assume?
• Does the documentation work end up back with your team anyway?

What does the Kertos external data protection officer cost?

Kertos does not bill by the hour and does not publish an entry price, because the effort depends on company size, data categories, tool landscape and the state of your existing documentation. You get a fixed annual budget based on a scoping exercise, with no per-request charges. The Kertos DPO mandate covers the appointment and notification to the supervisory authority including the appointment certificate, a structured kick-off that reviews your existing GDPR documentation and website settings, ongoing support from a named certified expert, and access to the platform with data discovery, RoPA, TOMs, DPIAs, vendor management, data subject requests, incident management and employee training.

What separates this from a classic consulting mandate is how much work stays with you. The AI agent KAIA and over 300 integrations handle inventory, evidence collection and documentation, while the certified expert makes the calls that need real expertise. Customers cut manual compliance effort by around 80 percent and compliance cost by up to 60 percent compared with traditional consulting. If ISO 27001, NIS2 or the EU AI Act come later, the documentation and the contact person stay the same.

What do customers say about the Kertos external DPO?

"The combination of automating our compliance and acting as our DPO is unique mix, making Kertos the most suitable solution for any European startup."

Maurice S., Co-Founder and CEO, G2

"We particularly appreciate the integrated DPO service, it's like having a data protection expert on board without the extra overhead."

Verified User, Renewables & Environment, G2

"Amazing support after the purchase; we booked the DPO and he already helped us so much, always fast to answer or hop on a call."

Philipp H., Co-Founder, B2B SaaS, G2

Kertos supports European tech companies with a 100 percent audit pass rate and 98 percent customer satisfaction. AskUI reached ISO 27001 in 8 to 10 weeks, with no external consultants. To find out what an external data protection officer would cost for your company, request a quote. For the background on the role itself, read what an external data protection officer actually does.