Article 37: Designation of the data protection officer
Praxikon tracks Article 37 (Designation of the data protection officer) under the GDPR, alongside the EU AI Act, citing the source for every statement.
What does Article 37 govern?
Article 37 determines when an organisation must designate a data protection officer (DPO). Under paragraph 1 this is mandatory for public authorities and bodies (except courts acting in their judicial capacity), for organisations whose core activities consist of regular and systematic monitoring of people on a large scale, and for organisations whose core activities consist of large-scale processing of special categories of data (Article 9) and criminal data (Article 10). The duty applies to the controller and to the processor alike. The DPO is chosen for expert knowledge of data protection law and practice (paragraph 5), may be an employee or an external person (paragraph 6), and the DPO's contact details are published and communicated to the supervisory authority (paragraph 7). The article exists because organisations with risky processing need someone with expertise who monitors compliance with the GDPR internally and independently (recital 97).
Key term: Core activities: the primary activities of an organisation, not the processing of personal data as an ancillary matter; only core activities count for the DPO duty in paragraph 1(b) and (c) (recital 97)
Directly affects:controllerprocessordata protection officersupervisory authoritymember state
Praxikon’s reading of the text and the recitals; the official text below prevails.
Official text
Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.
Decision tree
Do you need to designate a DPO?
The obligation applies to controllers and to processors. Assess it per organisation and record the outcome, even if you need not designate a DPO.
Question 1 · Art. 37(1)(a)
Is the processing carried out by a public authority or body, such as a municipality, ministry or independent administrative body?
Full diagram
- 1
Is the processing carried out by a public authority or body, such as a municipality, ministry or independent administrative body?
Art. 37(1)(a)
- Yes → Question 2
- No → Question 3
- 2
Is it a court acting in its judicial capacity?
Art. 37(1)(a)
- Yes → Outcome B
- No → Outcome A
- 3
Are the processing operations part of your core activities: the primary activities through which you achieve your goals, and not only supporting tasks such as payroll or IT support?
Art. 37(1)(b) en c · overweging 97
- Yes → Question 4
- No → Question 6
- 4
Do those core activities, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale?
Art. 37(1)(b)
- Yes → Outcome C
- No → Question 5
- 5
Do the core activities consist of large-scale processing of special category data or of criminal offence data?
Art. 37(1)(c) · richtsnoeren WP243
- Yes → Outcome C
- No → Question 6
- 6
Does Union or Member State law require you on another ground to designate a DPO?
Art. 37(4)
- Yes → Outcome C
- No → Question 7
- 7
Do you want to designate a DPO voluntarily?
Art. 37(4)
- Yes → Outcome D
- No → Outcome E
Outcome A · Applies
You must designate a DPO as a public body
Designate the DPO on the basis of expert knowledge of data protection. The DPO may be a staff member or engaged under a service contract. Publish the contact details and communicate them to the Dutch Data Protection Authority. Involve the DPO in good time, provide resources and give no instructions on the performance of the tasks. Several public authorities or bodies may share one DPO, taking account of their organisational structure and size.
Art. 37(1)(a) · Art. 37(3) · Art. 37(5) to (7) · art. 38
Outcome B · Does not apply
No DPO obligation for judicial tasks
The obligation does not apply to processing by courts acting in their judicial capacity. For other processing, such as internal operations, the obligation as a public body may still apply.
Art. 37(1)(a)
Outcome C · Applies
You must designate a DPO
Designate the DPO on the basis of expert knowledge of data protection. The DPO may be a staff member or engaged under a service contract. Publish the contact details and communicate them to the Dutch Data Protection Authority. Involve the DPO in good time, provide resources and give no instructions on the performance of the tasks. A group of undertakings may appoint a single DPO, provided the DPO is easily accessible from each establishment.
Art. 37(1)(b) en c · Art. 37(2) · Art. 37(5) to (7) · art. 38
Outcome D · Partly applies
Voluntary DPO: the same rules apply
If you designate a DPO voluntarily, the same requirements on position, independence and tasks apply as for a mandatory DPO. If you do not want that, choose another job title, such as privacy officer.
Art. 37(4) · art. 38 · art. 39
Outcome E · Does not apply
No DPO required
You need not designate a DPO. Record why not, and reassess when your core activities or the scale of processing change. Accountability for the GDPR stays with your organisation.
Art. 37(1) · Art. 5(2) · art. 24
What does this mean for you?
Controller
You check whether you fall under one of the three cases in paragraph 1: a public authority, large-scale regular and systematic monitoring as a core activity, or large-scale processing of special categories of data and criminal data as a core activity. If so, you designate a DPO with demonstrable expertise (paragraph 5), internal or external (paragraph 6), and you publish the contact details and communicate them to the supervisory authority (paragraph 7). If you do not fall under paragraph 1, you may designate a DPO voluntarily, unless Union or national law requires it anyway (paragraph 4).
Processor
The duty in paragraph 1 applies to you as processor too: if your core activities consist of large-scale processing of special categories of data and criminal data, or of large-scale monitoring of people on behalf of your clients, you designate a DPO yourself. The requirements on expertise (paragraph 5) and the publication of contact details (paragraph 7) apply to you as well.
Data Protection Officer
You are designated on the basis of your professional qualities, your expert knowledge of data protection law and practice and your ability to fulfil the tasks in Article 39 (paragraph 5). You may be an employee or work under a service contract (paragraph 6), and within a group of undertakings you may act for several establishments as long as you are easily accessible from each of them (paragraph 2). Recital 97 expects you to be able to perform your tasks independently.
Data Subject
The DPO's contact details are published (paragraph 7), so you can see whether an organisation has a DPO and how to reach that person.
Compliance checklist
Related recitals
Cross-references
More case law, guidelines and fines
In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.
Guidelines (1)
- 5 April 2017 · WP243 rev.01 · Article 29 Working PartyGuidelines on Data Protection Officers ('DPOs')
Describes when a data protection officer is mandatory and what position, independence and tasks the officer has.
Checked on 1 October 2026
Frequently asked questions
Connections
What connects to Article 37 GDPR
Themes where this returns
The counterpart in the other law
Legislation in motion
- Council: Cyprus Presidency tables negotiating mandate, Coreper vote of 26 June 2026 cancelled
2026-06-22 · under negotiation, Raad van de Europese Unie, Antici-groep (vereenvoudiging) en Coreper