The GDPR contains a large section about Data Protection Officer
(DPO) requirements: it reads almost like an extensive job
description with detailed information on appointment, position and
tasks of the DPO. But how do you know if a DPO is mandatory for
your organisation and whether you should consider outsourcing the
DPO role?
Appointment of a DPO is mandatory for companies who are:
- public authority
- regularly and systematically
monitoring data subjects on a large scale
- processing special categories of
data (medical/ethnic)
Think of companies
which are state financed or owned with a focus on tracing or
monitoring individuals through portable devices; companies
with customer loyalty programmes; or organisations in the health
care environment.
