The Data Protection Officer In The Company

The General Data Protection Regulation (GDPR) specifies when an enterprise needs to appoint a data protection officer (DPO). This officer acts as the first contact in all data security issues.

Under Article 37 GDPR, controllers and processors shall designate a data protection officer when their core activities consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or processing is carried out of special categories of data ("sensitive data") or personal data relating to criminal convictions and offences.

The obligation to appoint a DPO applies without regard to the company's size or number of staff. A group of undertakings may appoint a single data protection officer provided that such person is easily accessible from each establishment.