A data protection officer advises an organization on GDPR duties and monitors compliance. Three cases make a DPO mandatory: public authorities and large scale monitoring and large scale processing of sensitive data. Independence and top level reporting protect the DPO. Staff members and external contractors can both fill the role.
Many organizations ask whether GDPR forces them to appoint a DPO and what that person does all day. EDPB gives clear answers.
Facts follow the EDPB guidance for small businesses and the EDPB report on the 2023 coordinated action.
When is a DPO Mandatory?
GDPR Article 37 requires a DPO when any one of these applies:
- Public authorities that process personal data.
- Core activities involve regular and systematic monitoring of individuals on a large scale. CCTV and geolocation tracking are examples.
- Core activities involve large scale processing of sensitive data.
Voluntary appointment is allowed. GDPR rules on tasks and position then apply in full.
What are the Tasks of a DPO?
- Inform and advise the organization and its staff on data protection compliance.
- Monitor compliance.
- Advise on data protection impact assessments.
- Cooperate with the data protection authority and act as its contact point.
- Act as contact point for individuals.
EDPB notes that organizations often also assign the record of processing operations to the DPO.
How does GDPR Protect DPO Independence?
- No instructions. Organizations may not tell the DPO how to perform duties.
- No penalty. Dismissal or penalty for performing tasks is barred.
- Top level reporting. Reports go to the highest management level.
- No conflicting role. No DPO may take a role that decides the purposes and means of processing like chief executive or head of IT or head of HR.
Staff members and external contractors can both serve. External DPOs can be individuals or organizations under a service contract.
What did the 2023 EDPB Action Find?
EDPB surveyed 25 supervisory authorities and 17,490 responses. Twelve organizations in seven Member States admitted that they had no DPO where one was mandatory. EDPB says the true figure is likely higher.
Public sector DPOs had sufficient resources in 66 percent of cases and private sector DPOs in 91 percent. Median 13.82 percent of DPOs reported receiving instructions on how to perform tasks.
For related regulation guides see HIPAA compliance and PCI DSS compliance and cloud data protection controls.
Frequently Asked Questions
Who Must Appoint a DPO Under GDPR?
Public authorities and organizations with large scale monitoring or large scale processing of sensitive data as core activities.
Can a Company Appoint a DPO Voluntarily?
Yes. EDPB states the GDPR rules on tasks and position then apply in full.
Can the DPO be an External Contractor?
Yes. External DPOs can be individuals or organizations under a service contract.
Can a Chief Executive be the DPO?
No. EDPB states a DPO cannot take a role that decides the purposes and means of processing.
Who Receives Reports From the DPO?
Reports go to the highest management level.
Key Takeaways
- Article 37 makes a DPO mandatory in three cases.
- DPO tasks center on advice and monitoring and cooperation with authorities.
- DPOs work without instructions on how to perform tasks.
- Roles that decide processing purposes conflict with the DPO role.
- Staff members and external contractors can both serve.
Sources and References
Facts follow the European Data Protection Board. This guide is general information and not legal advice.
- Data protection officer (EDPB) www.edpb.europa.eu
- 2023 Coordinated Enforcement Action on DPOs (EDPB report) www.edpb.europa.eu