Compliance thresholds in the DACH region: when which duty applies
Many duties depend on numbers: from 50 employees whistleblower protection applies in Germany and Austria, from medium size NIS2 may apply, from 20 people processing data Germany requires a data protection officer, and above EUR 800,000 prior-year turnover the e-invoicing mandate starts in 2027 instead of 2028.
Last updated: 13.11.2026
This overview collects the thresholds at which compliance duties begin or end in the DACH region. It is ordered by type of threshold and links to detailed explanations.
Thresholds are usually checked per entity, not for the group. For NIS2, partner and linked enterprises may be counted for size; when in doubt, the question belongs in the applicability check.
| Threshold | Regulation | What it triggers | Territory | Explainer |
|---|---|---|---|---|
| Fewer than 10 employees and at most EUR 2 million turnover or balance sheet | European Accessibility Act, BFSG, BaFG | Microenterprise exemption for services | EU, Germany, Austria | Explainer |
| 20 people regularly processing personal data automatically | BDSG section 38 | Duty to appoint a data protection officer | Germany | Explainer |
| 50 employees | HinSchG, HSchG | Duty to operate an internal reporting channel | Germany, Austria | Explainer |
| From 50 employees or more than EUR 10 million turnover and balance sheet | German NIS2 act, NISG 2026 | Medium-sized companies in covered sectors become important entities | Germany, Austria | Explainer |
| From 250 employees or more than EUR 50 million turnover and more than EUR 43 million balance sheet | German NIS2 act, NISG 2026 | Large companies in highly critical sectors become essential entities | Germany, Austria | Explainer |
| Fewer than 250 employees | Swiss Data Protection Ordinance (DPO) Art. 24 | Exemption from the record of processing where risk is low | Switzerland | Explainer |
| Fewer than 250 employees | GDPR Art. 30(5) | Exemption from the record only for occasional processing without risk | EU | Explainer |
| More than EUR 800,000 total turnover in the previous year | Section 27(38) German VAT Act | Duty to issue e-invoices from 1 January 2027 instead of 2028 | Germany | Explainer |
| Invoice amount up to EUR 250 | Section 33 German VAT Implementing Ordinance | Small-amount invoice, no e-invoicing duty | Germany | Explainer |
| Contract value from CHF 5,000 | Federal administration requirements | Electronic invoice to the federal administration | Switzerland | Explainer |
| 25 % (Switzerland) or more than 25 % (Germany, Austria) of shares or votes | AMLA, GwG, WiEReG | Beneficial owner, reporting to the transparency register | Switzerland, Germany, Austria | Explainer |
| 1,000 employees in Germany | LkSG | Supply chain due diligence; narrowing of scope announced | Germany | |
| 45 million monthly active users in the EU | Digital Services Act | Additional duties for very large online platforms | EU | Explainer |
Notes
- As of 13 November 2026. Thresholds may shift through legislative changes; the overview is updated accordingly.
- Under NIS2 some entities are covered regardless of size, such as certain digital infrastructure providers.
Frequently asked questions
Do part-time staff count towards thresholds?
That depends on the regulation. For NIS2, the EU SME definition counts annual work units; for whistleblower protection, all employees generally count.
Are group companies added together?
Usually each entity is checked separately. For NIS2, linked enterprises may be included for size; the applicability check clarifies this.
Where can I find the deadlines for these duties?
In our overview of regulatory deadlines 2023 to 2028 and in the comparison of regulations in Switzerland, Germany and Austria.
Sources
- German Federal Data Protection Act (BDSG), section 38
- German HinSchG and Austrian HSchG
- Commission Recommendation 2003/361/EC on the definition of SMEs
- Swiss Data Protection Ordinance, SR 235.11, Art. 24
- Section 27(38) German VAT Act and section 33 VAT Implementing Ordinance
More overviews
- Regulatory deadlines 2023 to 2028: data protection, AI, cyber and anti-money laundering
- Beneficial ownership (UBO) thresholds by jurisdiction
- Recognised self-regulatory organisations (SROs) in Switzerland
- Thresholds in Swiss public procurement for 2026 and 2027
- Regulations in Switzerland, Germany and Austria compared
- Supervisory authorities in the DACH region: data protection, cybersecurity, AI and financial markets