{"answer_id":"praxikon:eu:gdpr:answer:functionaris-gegevensbescherming","canonical_page":"https://www.praxikon.com/en/antwoord/avg/functionaris-gegevensbescherming","query":"When must an organisation designate a data protection officer?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"functionaris-gegevensbescherming","question":"When must an organisation designate a data protection officer?","label":"Data protection officer","answer":"A data protection officer is mandatory (Article 37(1)): (a) for a public authority or body, except courts acting in their judicial capacity; (b) where the core activities consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; (c) where the core activities consist of processing on a large scale of special categories of data, such as health data, or of data relating to criminal convictions and offences. The size of the organisation plays no role. According to the guidelines, core activities are the key operations necessary to achieve the goals of the organisation, not supporting tasks such as payroll.","applied_to_question":null,"matched_terms":[],"articles":[{"article":37,"source_locator":"Art. 37(1)(a) to (c) GDPR","point":"The three cases of a mandatory DPO.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/37"},{"article":38,"source_locator":"Art. 38(3) GDPR","point":"The DPO acts independently.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/38"}],"case_law":[],"guidance":[{"id":"wp29-wp243","kind":"guidance","title":"Guidelines on Data Protection Officers ('DPOs')","issuer":"Article 29 Working Party","reference":"WP243 rev.01","ecli":null,"date":"2017-04-05","status":"final","point":"Guidelines on data protection officers: core activities and large scale.","source_url":"https://ec.europa.eu/newsroom/article29/items/612048","human_page":null}],"enforcement":[],"open_questions":["Is the large-scale processing a core activity or a supporting task?"],"human_page":"https://www.praxikon.com/en/avg/artikel/37","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}