As set out in the General Data Protection Regulation
(GDPR), a data protection officer (DPO) plays a crucial role in the
data privacy landscape. The provisions covering the designation,
position and tasks of a DPO are detailed in Articles 37, 38 and 39
of the GDPR.
Who needs to appoint a DPO?
In principle, public authorities and companies that carry
out systematic and regular monitoring of data subjects on a large
scale, or those whose core activities involve processing special
categories of data or criminal convictions on a large scale, should
appoint a DPO. However, European Union (EU) Member States have
established additional rules for appointing a DPO depending on, for
example, the number of employees the company has (i.e., Germany) or
the processing activities or industry of the company (i.e.,
Spain). The appointment of a DPO is not a requirement just
for controllers. Processors also must appoint a DPO if they meet
the thresholds mentioned above.
