The DPO’s role and position

When a DPO is required

Article 37 requires a DPO in three situations: the processing is carried out by a public authority or body (except courts acting in their judicial capacity); the core activities of the controller or processor consist of processing that requires regular and systematic monitoring of individuals on a large scale; or the core activities consist of large-scale processing of special categories of data or data about criminal convictions and offences. Member State law can require a DPO in other cases, and organisations that appoint one voluntarily must follow the same rules.

A group of undertakings may appoint a single DPO if the DPO is easily accessible from each establishment. The DPO may be a member of staff or work under a service contract, and must be designated on the basis of professional qualities and expert knowledge of data protection law and practice. The organisation must publish the DPO’s contact details and communicate them to the supervisory authority.

Position: involvement, resources and independence

• Involved properly and in a timely manner in all issues relating to the protection of personal data (Article 38(1)).
• Given the resources needed for the tasks, access to personal data and processing operations, and the means to maintain expert knowledge.
• Receives no instructions about how to carry out the tasks, and cannot be dismissed or penalised for performing them.
• Reports directly to the highest management level.
• May hold other tasks, provided they do not create a conflict of interests.
• Bound by secrecy or confidentiality in performing the tasks.

Tasks under Article 39

At a minimum the DPO informs and advises the organisation and its staff of their obligations; monitors compliance with the GDPR, other data protection law and internal policies, including the assignment of responsibilities, awareness-raising, training and audits; advises on data protection impact assessments and monitors their performance; cooperates with the supervisory authority; and acts as its contact point. The DPO must have due regard to the risk associated with processing operations.

Responsibility for compliance stays with the controller or processor, not with the DPO. The DPO advises; management decides — and should record why if it does not follow the advice.