According to Art. 37 (2) GDPR, a group of companies may appoint a joint data protection officer, provided that the data protection officer can be reached from each branch. This was already permissible and customary under the German Federal Data Protection Act (BDSG). The GDPR makes this even easier. A significant advantage of appointing a group data protection officer is the establishment of a uniform level of data protection in the entrepreneurial group through the central organization.
Various models are available to achieve this purpose. Under the so-called single model, one and the same person can hold the function of data protection officer for several or all group companies. In this case, each group subsidiary has properly appointed this person as Group Data Protection Officer. The larger the corporate group, the more resources and employees the Group Data Protection Officer requires in the single model.
An alternative to this is the so-called coordinator model. In this model, each company in the group appoints its own data protection officer, while the group-wide data privacy organization is coordinated by a Group Data Protection Officer. What both models have in common is that all the threads come together at one expert office in order to find uniform solutions for cross-company issues in data privacy.