GDPR, Part III: The Data Protection Officer Requirement

This seven-part series analyzes the ways in which the forthcoming General Data Protection Regulation (GDPR), effective May 25, 2018, will impact the regulatory landscape for entities doing business with or transacting in the data of European Union citizens. The  first part of this series provided an overview of the history of pre-GDPR European data protection law. The second installment focused on the GDPR's breach notification requirements. The third installment, below, addresses when and how a data protection officer (DPO) may need to be appointed under the GDPR. Future installments of this series will address discrete additional aspects of the new regulation helpful to entities seeking to maintain an appropriate organizational compliance posture.