Data protection officer vacancy: interim appointment done right

Short answer: When the data protection officer (DPO) role falls vacant, a company in Germany that is required to have a DPO must appoint a new person, publish the contact details and communicate them to the supervisory authority (Art. 37(7) GDPR). The duty applies in particular where, as a rule, at least 20 people are constantly engaged in the automated processing of personal data (section 38(1) of the Federal Data Protection Act, BDSG). An external DPO under a service contract is also permitted as cover (Art. 37(6) GDPR). In Switzerland, a data protection adviser is voluntary (Art. 10 of the Data Protection Act, DSG); companies that want to rely on the relief in Art. 23(4) DSG publish the adviser's contact details and notify them to the Federal Data Protection and Information Commissioner (FDPIC).

This guide is for general counsel, compliance and data protection leads and management teams in Germany and Switzerland whose DPO is absent or leaving. It explains the legal position on covering the DPO role, how to make an interim appointment work and what belongs in the handover.

Germany: duty to appoint and notification

In Germany, a company must appoint a DPO if one of the conditions in the GDPR or the BDSG is met; the duty is continuous and does not pause during a vacancy.

• Art. 37(1) GDPR: always for public authorities; for companies whose core activities involve large-scale, regular and systematic monitoring of individuals or large-scale processing of special categories of data or criminal offence data.
• Section 38(1) BDSG: where, as a rule, at least 20 people are constantly engaged in automated processing of personal data. Regardless of headcount, where processing is subject to a data protection impact assessment, or where personal data is processed commercially for transfer, anonymised transfer or market and opinion research.

Rules for the appointment

• Qualification: the DPO is appointed on the basis of professional qualities and expert knowledge of data protection law and practice (Art. 37(5) GDPR).
• Internal or external: the DPO may be an employee or fulfil the tasks under a service contract (Art. 37(6) GDPR).
• Groups: a group of undertakings may appoint a single DPO, provided the DPO is easily accessible from each establishment (Art. 37(2) GDPR).
• Notification: publish the contact details and communicate them to the supervisory authority (Art. 37(7) GDPR). This applies to every change, including an interim solution.
• Protection against removal: where appointment is mandatory, the DPO may only be removed on grounds that would justify termination for cause under section 626 of the Civil Code (BGB); the employment relationship may only be terminated for cause during the term and for one year afterwards (section 38(2) in conjunction with section 6(4) BDSG).

A missing mandatory DPO can lead to a fine: breaches of Art. 37 to 39 GDPR carry fines of up to EUR 10 million or 2% of worldwide annual turnover (Art. 83(4)(a) GDPR).

Announced change

In the Federal Modernisation Agenda of 4 December 2025, the federal government committed to introducing a bill by 31 December 2026 that would repeal section 38(1) BDSG and limit the duty to appoint a DPO to Art. 37 GDPR. No law has been passed so far; section 38 BDSG still applies unchanged (as of 31 October 2026). The duty under Art. 37(1) GDPR would remain in any case.

Switzerland: the voluntary data protection adviser

In Switzerland, there is no duty to appoint a data protection adviser; private controllers may do so (Art. 10(1) DSG). The adviser is the point of contact for data subjects and authorities, trains and advises the controller and helps apply data protection rules (Art. 10(2) DSG).

The role matters most for data protection impact assessments. If a high risk remains after a DPIA, the controller must normally consult the FDPIC in advance, which has two months to raise objections (Art. 23(1) and (2) DSG). This consultation can be skipped if the controller has consulted its data protection adviser instead (Art. 23(4) DSG). The conditions under Art. 10(3) DSG are:

• the adviser acts independently and without instructions,
• the adviser has no tasks incompatible with the role,
• the adviser has the necessary expertise,
• the contact details are published and notified to the FDPIC.

Swiss companies therefore do not have to fill a vacant adviser role. Without an adviser, however, the relief under Art. 23(4) DSG is lost, and any published contact details must be updated. The wording does not rule out an external adviser; this is an interpretation, not an express provision. Swiss companies that are also subject to the GDPR should check Art. 37 GDPR as well. This is the case if they have an establishment in the EU (Art. 3(1) GDPR) or offer goods or services to, or monitor the behaviour of, people in the EU (Art. 3(2) GDPR).

Germany and Switzerland compared

The table compares the duty, threshold, notification and status of the data protection role in both countries, with the relevant provisions.

Interim appointment: independence and conflicts of interest

An interim appointment works if the DPO's statutory status is preserved throughout the fixed-term assignment. Neither the GDPR nor the German Federal Data Protection Act (BDSG) prescribes a minimum term of appointment (Article 37 GDPR, section 38 BDSG). The term, any extension and the end of the appointment should therefore be set out in writing in advance, so that the DPO's position under Article 38 GDPR is preserved throughout the assignment.

What the status requires

• Early involvement in all data protection matters and the necessary resources and access (Art. 38(1) and (2) GDPR).
• No instructions on how the tasks are carried out, no removal or penalty for performing them, reporting to the highest management level (Art. 38(3) GDPR).
• Confidentiality (Art. 38(5) GDPR).
• Other tasks only if they do not create a conflict of interest (Art. 38(6) GDPR).

Staff leasing or freelancing

DPOs can be engaged through either model, and the independence required by law is preserved. In staff leasing (Personalverleih in Switzerland, Arbeitnehmerüberlassung in Germany), the client generally has the right to give instructions on the work. For the DPO tasks, that right is limited by Art. 38(3) GDPR. In freelancing, the professional works independently within the agreed mandate anyway, which matches the external DPO under Art. 37(6) GDPR. Through staff leasing, by contrast, the person is fully integrated into the organisation, which makes access and involvement easier.

Avoiding conflicts of interest

Roles in which a person decides on the purposes and means of processing, such as executive management or heads of IT, HR or marketing, are regarded as conflicted. This is the position of the DPO guidelines endorsed by the EDPB (WP 243 rev.01). The CJEU requires a case-by-case assessment (judgment of 9 February 2023, C-453/21, X-FAB). A dual role in projects is also delicate: an interim DPO who writes a DPIA personally will later monitor their own work. A better split is for a project team to prepare the DPIA while the DPO advises and monitors (Art. 39(1)(c) GDPR). What such a team looks like is described in legal support for data protection projects.

Steps for an interim appointment

1. Check the duty and legal basis (Art. 37 GDPR, section 38 BDSG or Art. 10 DSG).
2. Define the profile: expertise, sector, languages, workload, availability.
3. Choose the model: internal integration through staff leasing, or an external DPO through freelancing.
4. Check conflicts of interest and document the outcome.
5. Appoint in writing: tasks, resources, reporting line, term, deputy.
6. Update contact details in the privacy notice and intranet and notify the supervisory authority or the FDPIC.
7. Inform staff and business units.
8. Plan the handover from the predecessor and, later, to the successor.

Handover: what the interim DPO needs

A good handover determines whether the cover can act from day one. These documents should be ready:

• the record of processing activities, with status and gaps,
• ongoing and completed data protection impact assessments,
• the breach register and notifications made,
• open access and erasure requests with deadlines,
• correspondence and ongoing proceedings with supervisory authorities,
• the list of processors and international transfers,
• the training plan and training records,
• the monitoring and audit plan and the latest activity report,
• access to systems, mailbox and files of the data protection function.

When the cover ends, the same applies in reverse, and the contact details must again be updated and notified. The differences between the two regimes are covered in more depth in GDPR vs the Swiss FADP.

Limits and risks

• Responsibility stays with the company: the DPO advises and monitors. The company, as controller, remains responsible for compliance with data protection law.
• No legal advice from Alpinum: Alpinum is not a law firm. Alpinum Solutions provides professionals who can take on formal roles such as DPO, depending on the client's requirements and the rules in Germany or Switzerland.
• Avoid a gap: where appointment is mandatory, the interim solution should be in place before the current DPO leaves.
• Availability: a part-time mandate needs clear availability for data breaches, where the GDPR allows 72 hours for notification (Art. 33 GDPR).

Frequently asked questions about covering the data protection officer

Must the supervisory authority be informed?

In Germany, yes. The controller publishes the DPO's contact details and communicates them to the supervisory authority (Art. 37(7) GDPR). This also applies to an interim appointment, and again when the successor starts. In Switzerland, notifying the FDPIC is only necessary if the company wants to rely on the relief in Art. 23(4) DSG.

May an interim DPO take on other tasks?

Yes, provided those tasks do not create a conflict of interest (Art. 38(6) GDPR). Training or contributing to policies, for example, is unproblematic. Roles in which the person decides on the purposes and means of processing, or writing documents they will later monitor, are critical. In Switzerland, Art. 10(3)(b) DSG applies.

How quickly must the role be filled?

The law sets no deadline, because the duty under Art. 37 GDPR and section 38 BDSG applies continuously. A gap should therefore be avoided and can be fined under Art. 83(4) GDPR. In practice, the interim solution should be agreed before the outgoing DPO's last working day so that handover and notification follow seamlessly.

Does a Swiss company need a data protection adviser?

No, the DSG does not require one (Art. 10(1) DSG). An adviser is most useful for companies with many data protection impact assessments: consulting the adviser allows the company to skip prior consultation of the FDPIC (Art. 23(4) DSG), provided the adviser is independent and the contact details are published and notified.

Does protection against removal apply to an interim DPO?

Where appointment is mandatory, the DPO may only be removed by analogy with section 626 of the German Civil Code, i.e. for good cause (section 6(4) in conjunction with section 38(2) BDSG). The additional protection against dismissal relates to the employment relationship and continues for one year after the role ends. The Act does not expressly say how these rules apply to an appointment that is fixed-term from the outset or to an external DPO under a service contract. Companies should therefore set out the term and termination in the contract and have them reviewed by a data protection lawyer.

Next step

If your DPO role falls vacant or you are looking for a data protection adviser, Alpinum provides experienced data protection professionals through staff leasing or freelancing. Selected profiles are usually available within 48 hours; the start date of the assignment is agreed between the client and Alpinum.

• Data protection and AI governance
• Legal support for data protection projects
• GDPR vs the Swiss FADP
• Discuss your requirements

Last updated: 31 October 2026.