Appointment Of A Data Protection Officer (DPO) As An Obligation Of The Data Controller

Although the General Data Protection Regulation (GDPR) has been in force for over six years, many organizations have still not conducted an assessment to determine whether appointing a Data Protection Officer (DPO) is necessary.

Every data controller should conduct such an analysis, as ignoring this obligation may result in serious legal and organizational consequences, as indicated in a recently issued decision by the President of the Personal Data Protection Office.

When is it mandatory to appoint a data protection officer?

According to Article 37 of the GDPR, the data controller and the data processor are obligated to appoint a data protection officer if they meet at least one of the following conditions: