Germany May Scrap Its 20-Employee DPO Rule in 2026 — Which Makes the Decision Logic Harder, Not Easier

On December 4, 2025, Germany's federal and state governments signed off on a "Modernisierungsagenda" that includes, as point 160, a commitment: the federal government will submit a bill to repeal § 38 Abs. 1 BDSG by December 31, 2026.

That single paragraph of a coalition document is the kind of thing that matters a lot if you run a site that tries to tell German businesses, in plain language, which compliance officer they're legally required to appoint. I maintain beauftragten-finder.de, a guide site covering exactly that question — Datenschutzbeauftragter, Brandschutzbeauftragter, and the half-dozen other "Beauftragte" roles German law scatters across different statutes. § 38 BDSG is the one with the cleanest rule of all of them, which is exactly why losing it is interesting.

The rule as it stands today

§ 38 Abs. 1 BDSG requires a company to appoint a data protection officer if at least 20 people are "constantly engaged in the automated processing of personal data." Two details trip people up every time: it's not headcount, it's people who regularly handle personal data (so part-time HR or customer-service staff count, a warehouse crew mostly doesn't); and the threshold itself moved once already, from 10 to 20, at the end of 2019. It is, as these things go, a genuinely simple rule to encode: count the relevant employees, compare to 20, done. A website can ask three questions and give a correct answer.

What the 2026 proposal actually changes

The Modernisierungsagenda commitment is to submit a bill, not to have passed one — as of writing, no legal change has entered into force, and several outlets covering it (dr-datenschutz.de among them) are careful to say so. If it does go through roughly as described, the German-specific headcount trigger disappears, and private-sector DPO obligations fall back entirely on Article 37 GDPR.

Article 37 doesn't count employees. It asks whether your core activities involve "regular and systematic monitoring of data subjects on a large scale," or large-scale processing of special-category data (health records, biometrics, criminal records, and the like). Those are judgment calls about what a business actually does, not a number you can pull from payroll.

Why that's a harder problem to put on a page

Given my day job, this is the part I find genuinely interesting rather than just newsworthy. A threshold rule like "20 employees" is a solved problem for a decision-guide site: one comparison, one answer, and the answer doesn't need a caveat. "Large-scale systematic monitoring" is not that. A 15-person startup running a behavioral ad-tech product that profiles every visitor on the web might clear the Article 37 bar easily, while a 50-person logistics company with a straightforward payroll system might not come close — and no amount of yes/no questions fully resolves that without a few paragraphs of "it depends, and here's what regulators have actually said."

That's a different kind of content than a threshold checker: less a calculator, more a set of worked examples and the EDPB's own guidance on what counts as "large scale" (volume of data subjects, duration, geographic extent, among other factors). If § 38 does go away, the honest version of a site like ours has to replace a clean gate with exactly that — which is more work to write and harder to get wrong, but also a more accurate reflection of what German and EU law actually ask of a business.

The practical takeaway, regardless of what happens in 2026

Article 37 already applies today, on top of § 38, to any company whose core activity fits its criteria — headcount has never been a safe harbor for that half of the rule. If the German threshold disappears, nothing about your actual processing changes; only the easy way of ruling yourself out does. Companies currently relying on "we have fewer than 20 people" as their only answer are the ones who should look at Article 37 now, not wait for a bill that, as of this writing, hasn't been introduced.

We're tracking the proposal and will update the KMU-specific guide if and when an actual draft bill appears.