Once you know you need a DPO, the real decision is internal vs. external. Both are legally valid; the question is which works in practice at your size. For most SMEs the external model wins on three fronts - cost, continuity and independence - while management liability stays the same either way. This guide compares them head to head and shows when an internal hire actually makes sense. For models and pricing, see the external DPO pillar.
- External wins on cost (€150-1,500/mo vs €60-90k/yr), continuity, and structural independence.
- Independence is the quiet dealbreaker: SME internal candidates usually have conflicting operational roles.
- Either way, the Managing Director keeps the liability - the DPO advises, it doesn't transfer accountability.
Internal vs. External: Head to Head
How do the two models compare?
| Criterion | Internal DPO | External DPO |
|---|---|---|
| Cost | €60,000-90,000/year | €150-1,500/month |
| Setup | Recruit, qualify, define role | Contract and handover |
| Expertise | Depends on the individual | Specialised, kept current |
| Independence | High conflict risk in an SME | Structurally independent |
| Continuity | Limited by leave, illness, turnover | Contractually defined |
| AI Act coverage | Rarely included | Often included (ETHYX: native) |
Why Independence Is the Quiet Dealbreaker
What makes internal hard for an SME?
GDPR Art. 38 requires the DPO to act without instruction on their DPO duties and not be penalised for them - which means real separation from the operations they oversee. In a 40-person company, the people qualified to take it on (Head of IT, COO, HR, legal) all run functions the DPO is meant to check. That conflict is structural, not a matter of good intentions, and it's the most common reason an internal appointment fails scrutiny. An external DPO sidesteps it entirely.
Liability: What Doesn't Change
Does outsourcing move the risk?
No. Whichever model you choose, the Managing Director can still be personally liable (under German law: §130 OWiG, §43 GmbHG) - for failing to appoint a mandatory DPO and for demonstrably inadequate organisational measures. The DPO advises, reviews and documents; accountability for decisions stays with management. Outsourcing buys expertise and continuity, not a transfer of liability - and that's the correct expectation to set.
When an Internal DPO Makes Sense
Is internal ever the right call?
Yes - typically at around 250+ employees, where the volume of data decisions justifies a dedicated role that can be kept fully separate from operations. Below that, the cost is disproportionate and the independence hard to maintain, which is why most SMEs between 20 and 150 employees choose external.
ETHYX is the external-DPO model done in full - a certified DPO plus the platform and AI Act coverage from €299/month, with the independence and continuity an internal hire struggles to match.