DPO: who it is and when one is mandatory

In short

The DPO is not the data controller and is not the "processor" (the supplier that processes data on the company's behalf): the DPO is an independent internal or external adviser who monitors and advises. Decisions, and responsibility for complying with the GDPR, remain with the controller.

When it is mandatory

Article 37 requires one in three cases:

• the processing is carried out by a public authority or body, except courts acting in their judicial capacity;
• the core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale;
• the core activities consist of processing special categories of data on a large scale (for example health data) or data relating to criminal convictions and offences.

In other cases the appointment is optional, but if the company appoints a DPO the same rules apply. The DPO can be an employee or an external professional under a service contract; their contact details must be published and communicated to the Garante (the Italian Data Protection Authority).

Requirements and tasks

The DPO must have expert knowledge of data protection law and practice. Article 38 protects their independence: they receive no instructions on how to carry out their tasks, cannot be dismissed or penalised for performing them, report directly to the highest management level and must not have a conflict of interest (for example, whoever decides the purposes and means of processing cannot monitor it). Article 39 lists the tasks: informing and advising the controller and employees, monitoring compliance with the GDPR (including through audits and training), providing advice on the data protection impact assessment, cooperating with the Garante and acting as its contact point.

Why it matters

During a data breach, the DPO is often the person who helps assess the risk to data subjects and prepare the notification within 72 hours. To do this well they need up-to-date tools: the records of processing, the appointments, documented security measures. It is useful for them to have a defined role in the company CSIRT.

Example

A private outpatient clinic processes the health data of thousands of patients every day: this is large-scale processing of special categories, so a DPO is mandatory. Management gives the role to an external consultant, communicates their details to the Garante and publishes them on the website. The DPO reviews the records of processing, points out that medical records are also stored in a shared folder accessible to all administrative staff and recommends restricting access. The decision, and the fix, are the controller's.

Related terms

• Data breach
• System administrator
• CSIRT
• Residual risk