Direct answer · GDPR
Data protection officer
A data protection officer is mandatory (Article 37(1)): (a) for a public authority or body, except courts acting in their judicial capacity; (b) where the core activities consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; (c) where the core activities consist of processing on a large scale of special categories of data, such as health data, or of data relating to criminal convictions and offences. The size of the organisation plays no role. According to the guidelines, core activities are the key operations necessary to achieve the goals of the organisation, not supporting tasks such as payroll.
For you to establish
- Is the large-scale processing a core activity or a supporting task?
Articles
- Art. 37(1)(a) to (c) GDPR The three cases of a mandatory DPO.
- Art. 38(3) GDPR The DPO acts independently.
Guidelines and decisions
- Guidelines on Data Protection Officers ('DPOs') (Article 29 Working Party, WP243 rev.01, 2017-04-05)Guidelines on data protection officers: core activities and large scale.
