When must a Data Protection Officer be appointed?

In brief

A Data Protection Officer is the person who advises the organisation on data protection duties, monitors compliance and acts as a contact point for the supervisory authority. Under the General Data Protection Regulation's Article 37, the role is mandatory for public authorities and public bodies, except courts acting in their judicial capacity, and for organisations whose core activities involve certain large-scale monitoring or sensitive processing. The person must have expert knowledge of data protection law and practices, and must be able to carry out the tasks in Article 39. Appointment is not enough on its own: the organisation must give the Data Protection Officer independence, access, resources and a direct reporting line to top management.

When is a Data Protection Officer mandatory?

The General Data Protection Regulation's Article 37 sets three mandatory cases.

A Data Protection Officer must be appointed when personal data processing is carried out by a public authority or public body. The exception is a court acting in its judicial capacity. For a municipality, this means the duty is usually a structural governance question, not a case-by-case project question.

A Data Protection Officer must also be appointed when the controller's or processor's core activities consist of processing operations that require large-scale regular and systematic monitoring of data subjects because of their nature, scope or purposes. A processor is a service provider that processes personal data for another organisation's account, as described in the General Data Protection Regulation's Article 28. Monitoring means ongoing observation or evaluation, for example when a service keeps tracking how identified people use it.

The third mandatory case concerns core activities that consist of large-scale processing of special categories of personal data under the General Data Protection Regulation's Article 9, or data on criminal convictions and offences under Article 10. The provided rule does not define a fixed numerical threshold for large scale. The organisation must therefore look at the nature, scope and purpose of the processing.

Article 37 also allows a group of undertakings to appoint one Data Protection Officer if the person can be easily contacted from each establishment. Public authorities and public bodies may also appoint one Data Protection Officer for several authorities or bodies, taking account of their organisational structure and size.

What does appointment require in practice?

Appointment is a formal role with practical consequences.

The General Data Protection Regulation's Article 37 says the Data Protection Officer must be chosen with regard to professional qualities, especially expert knowledge of data protection law and practices, and the ability to perform the tasks in Article 39. The role can be held by an employee. It can also be performed under a service contract.

The organisation must publish the Data Protection Officer's contact details and communicate them to the supervisory authority. This matters in everyday work because employees, customers, residents and the authority must know where to send data protection questions.

The appointment should fit the organisation's actual processing. A small internal register is different from a public service, a health-related process, a large customer platform or a system that monitors users over time. The General Data Protection Regulation's Article 39 also says the Data Protection Officer must take due account of the risk connected with processing operations, considering their nature, scope, context and purposes.

This is why the role is not only legal reading. It also requires an operational view of systems, vendors, retention, access rights, incidents and decision-making.

What must a Data Protection Officer know?

The required competence follows from the tasks the role must be able to perform.

The General Data Protection Regulation's Article 39 requires the Data Protection Officer to inform and advise the controller or processor and employees who process personal data. This means the person must understand the controller's duties under Article 24 and the accountability principle in Article 5. Accountability means the controller is responsible for compliance and must be able to show it.

The Data Protection Officer must monitor compliance with the regulation, other data protection rules and the organisation's own data protection policies. Article 39 includes assignment of responsibilities, awareness-raising, training of staff involved in processing and related audits. In practice, this means the person must understand how data protection is organised, not only what a privacy notice says. Basic data protection competence for the wider workforce is a related topic in What data protection skills does every employee need?.

The role also needs strong knowledge of data subject rights. The General Data Protection Regulation's Articles 12 to 22 cover transparent information, access, rectification, erasure, restriction, portability, objection and automated individual decisions. For example, Article 12 sets time limits for responding to requests: the controller must provide information without undue delay and in any event within one month, with a possible extension of up to two further months when necessary because of the complexity and number of requests.

The Data Protection Officer must understand breach handling. The General Data Protection Regulation's Article 33 requires the controller to notify a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. Article 34 concerns communication to the data subject when the breach is likely to result in a high risk.

The role also needs competence in records, contracts and transfers. Article 30 concerns records of processing activities. Article 28 concerns processors and the contract or other legal act that governs processing for the controller. Articles 44 to 49 concern transfers of personal data to third countries or international organisations.

The Data Protection Officer's position must be protected

The General Data Protection Regulation's Article 38 protects the role so that it can work in practice.

The organisation must involve the Data Protection Officer properly and in good time in all issues relating to personal data protection. Late consultation is a common operational problem. If a new system, outsourcing or artificial intelligence use case is already decided, the advice may arrive too late to shape the processing.

The organisation must support the Data Protection Officer by providing the resources needed for the tasks, access to personal data and processing operations, and support for maintaining expertise. This makes training and time part of the role, not an optional extra.

The Data Protection Officer must not receive instructions on how to perform the role's tasks. The controller or processor must not dismiss or penalise the person for performing those tasks. The Data Protection Officer must report directly to the highest management level of the controller or processor.

Data subjects may contact the Data Protection Officer about processing of their personal data and the exercise of their rights under the regulation. The role is also bound by secrecy or confidentiality under Union or Member State law. Other tasks are allowed, but the controller or processor must ensure that they do not create a conflict of interests.

What tasks does the Data Protection Officer have?

The General Data Protection Regulation's Article 39 gives the minimum task list.

The Data Protection Officer must:

• inform and advise the controller or processor and employees who process personal data;
• monitor compliance with the regulation, other data protection rules and internal policies;
• support responsibility allocation, awareness-raising, staff training and audits connected with personal data protection;
• give advice on a data protection impact assessment when asked, and monitor its performance under Article 35;
• cooperate with the supervisory authority;
• act as the contact point for the supervisory authority on processing issues, including prior consultation under Article 36 where relevant.

A data protection impact assessment is an advance assessment of how planned processing affects personal data protection. The General Data Protection Regulation's Article 35 requires it when a type of processing, especially using new technology, is likely to result in a high risk to natural persons' rights and freedoms. Article 35 lists cases where it is required, including certain automated evaluations leading to significant decisions, large-scale processing of special categories of data or criminal conviction and offence data, and large-scale systematic monitoring of a publicly accessible area.

Artificial intelligence can increase the need for impact assessment competence

Artificial intelligence can add a second impact assessment layer.

The Artificial Intelligence Act's Article 27 requires certain deployers of high-risk artificial intelligence systems to assess possible effects on fundamental rights before first use. The duty covers deployers that are bodies governed by public law or private entities providing public services, and deployers of the high-risk artificial intelligence systems referred to in Annex III, point 5(b) and (c). The article excludes high-risk artificial intelligence systems intended for use in the area listed in Annex III, point 2.

The assessment must describe the deployer's processes where the system is used, the intended period and frequency of use, the categories of natural persons and groups likely to be affected, specific risks of harm, human oversight measures and steps to take if risks materialise.

The Artificial Intelligence Act's Article 27 also says that when some obligations have already been fulfilled through a data protection impact assessment under the General Data Protection Regulation's Article 35, the fundamental rights impact assessment supplements that data protection impact assessment. For a Data Protection Officer, this creates a practical competence need at the boundary between data protection, automated decisions and artificial intelligence governance. AI literacy as a staff duty is discussed separately in Article 4 of the AI Act: what your staff must know about AI.

When does the duty not apply, and what does the Data Protection Officer not do?

The appointment duty does not apply merely because an organisation processes some personal data. Outside the three mandatory cases in the General Data Protection Regulation's Article 37, the controller or processor may appoint a Data Protection Officer voluntarily, unless Union or Member State law requires it.

The role also does not transfer legal responsibility away from the organisation. The General Data Protection Regulation's Article 5 says the controller is responsible for compliance with the personal data processing principles and must be able to demonstrate it. Article 24 requires the controller to implement appropriate technical and organisational measures to ensure and show that processing complies with the regulation.

The Data Protection Officer is therefore not the owner of every data protection risk. The role advises, monitors, supports and acts as a contact point. Management still needs to make decisions, allocate resources and ensure that processing is lawful in practice.

The law also leaves judgement calls. Article 37 uses expressions such as core activities, large-scale processing, and regular and systematic monitoring. The provided articles do not turn those expressions into one fixed headcount, register size or revenue threshold. A credible appointment decision is therefore based on the organisation's actual processing and a documented view of risk.