Article 38: Position of the data protection officer

Praxikon tracks Article 38 (Position of the data protection officer) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Official text

The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.

The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.

The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.

Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.

The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law.

The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 39: Tasks of the data protection officer

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (2)

9 February 2023 · C-453/21 · CJEU
X-FAB Dresden
A conflict of interests can exist where the data protection officer is given tasks in which they determine purposes and means of processing. Extra national protection against dismissal remains allowed.
22 June 2022 · C-534/20 · CJEU
Leistritz
Member States may give the data protection officer extra protection against dismissal, such as dismissal only for just cause, as long as this does not undermine the GDPR's objectives.

Guidelines (1)

5 April 2017 · WP243 rev.01 · Article 29 Working Party
Guidelines on Data Protection Officers ('DPOs')
Describes when a data protection officer is mandatory and what position, independence and tasks the officer has.

Checked on 1 October 2026

← Art. 37: Designation of the data protection officer Art. 39: Tasks of the data protection officer →

Connections

Article 38: Position of the data protection officer

Official text

Cross-references

More case law, guidelines and fines

Case law (2)

Guidelines (1)

What connects to Article 38 GDPR

Themes where this returns

The counterpart in the other law

Enforcement and fines