TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

The Privacy Advisor | Top 10 operational impacts of the GDPR: Part 2 - The mandatory DPO Related reading: Top 10 operational impacts of the GDPR: Part 1 – data security and breach notification



The new General Data Protection Regulation (GDPR) is set to replace the Data Protection Directive 95/46/ec effective May 25, 2018. The GDPR is directly applicable in each member state and will lead to a greater degree of data protection harmonization across EU nations.

Although many companies have already adopted privacy processes and procedures consistent with the Directive, the GDPR contains a number of new protections for EU data subjects and threatens significant fines and penalties for non-compliant data controllers and processors once it comes into force in the spring of 2018.

With new obligations on such matters as data subject consent, data anonymization, breach notification, trans-border data transfers, and appointment of data protection officers, to name a few, the GDPR requires companies handling EU citizens’ data to undertake major operational reform.

This is the second in a series of articles addressing the top 10 operational impacts of the GDPR. Find Part 1 here

GDPR acknowledges value of “privacy on the ground” by requiring designation of a data protection officer

Data controllers and processors alike must designate a data protection officer to comply with the new EU General Data Protection Regulation. Under Article 37 of the GDPR, data protection officers must be appointed for all public authorities, and where the core activities of the controller or the processor involve “regular and systematic monitoring of data subjects on a large scale” or where the entity conducts large-scale processing of “special categories of personal data” (such as that revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and the like, defined in Article 9). Although an early draft of the GDPR limited mandatory data protection officer appointment to companies with more than 250 employees, the final version has no such restriction.

Article 37 does not establish the precise credentials data protection officers must carry, but does require that they have “expert knowledge of data protection law and practices.” The GDPR’s recitals suggest the level of expert knowledge “should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor.”

The data protection officer’s tasks are also delineated in the Article 39 of the Regulation to include:

  • Informing and advising the controller or processor and its employees of their obligations to comply with the GDPR and other data protection laws.
  • Monitoring compliance with the GDPR and other data protection laws, including managing internal data protection activities, training data processing staff, and conducting internal audits.
  • Advising with regard to data protection impact assessments when required under Article 35.
  • Working and cooperating with the controller’s or processor’s designated supervisory authority and serving as the contact point for the supervisory authority on issues relating to the processing of personal data.
  • Being available for inquiries from data subjects on issues relating to data protection practices, withdrawal of consent, the right to be forgotten, and related rights.

These responsibilities mirror those of privacy professionals elsewhere around the globe and signal a growth spurt for the profession in the EU. In fact, the GDPR borrows some concepts from Germany’s Federal Data Protection Act, which already requires a data protection officer to be appointed by firms with at least nine people employed in the automated processing of personal data, or at least 20 people who are engaged in non-automated data processing.  Under German law, data protection officers must be suitably qualified and are protected against dismissal except for severe breach of their duties.  Many firms out-source the data protection officer responsibilities to specialized agencies or law firms. Failure to comply with Germany’s compulsory data protection officer requirements can lead to significant fines. 

Under the Regulation, moreover, data protection officers have many rights in addition to their responsibilities. They may insist upon company resources to fulfill their job functions and for their own ongoing training. They must have access to the company’s data processing personnel and operations, significant independence in the performance of their roles, and a direct reporting line “to the highest management level” of the company. Data protection officers are expressly granted significant independence in their job functions and may perform other tasks and duties provided they do not create conflicts of interest. Job security is another perk; the GDPR expressly prevents dismissal or penalty of the data protection officer for performance of her tasks and places no limitation on the length of this tenure.

A company with multiple subsidiaries (a “group of undertakings”) may appoint a single data protection officer so long as she is “easily accessible from each establishment.” The GDPR also allows the data protection officer functions to be performed by either an employee of the controller or processor or by a third party service provider, creating opportunities for consulting and legal firms to offer outside DPO services.

Where to find the rules

Looking to dive deeper into the General Data Protection Regulation to read the text regarding the mandatory DPO for yourself? Find the full text of the Regulation here in our Resource Center.

You’ll want to focus on these portions:


(97) Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation. In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal data as ancillary activities. The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.


Article 4, Definitions

– 7 controller

– 8 processor

– 19 group of undertakings

Article 9, Processing of special categories of personal data

Article 10, Processing of data relating to criminal convictions and offences

Article 37, Definition of the data protection officer

Article 38, Position of the data protection officer

Article 39, Tasks of the data protection officer


If you want to comment on this post, you need to login.

  • comment Gonca Gokgoz Dhont, CIPP/E, CIPM • Jan 8, 2016
    Rita, great article, thanks! I think there are still a couple of points everyone needs to think about. I will list only two here leaving the rest for our website.
    1 - Processing involving 'regular and systematic monitoring of data subjects'. I wanted to find a description of 'monitoring', as we all know that it can mean a lot of different things in the privacy universe! There is Recital 21 and the definition is tightly attached to 'online behaviour tracking' (anyone seen another definition?). So, if we apply this definition to the DPO-appointment-criteria, many companies who deal with 'big data' (no internet behaviour tracking, just processing big data due to nature of its industry) may still fall out of the DPO appointment obligation. This looks a bit weird to me if the purpose was to ensure that big data companies are better guided around compliance through an expert. If I did not have the Recital 21 in front of me, I would normally take Article 35/1b in a broad sense; and consider 'any' company which handles data on a big large scale- be it through online tracking or otherwise - must take a DPO in Europe (if subject to GDPR, of course). 
    2- "A group of companies may appoint a single DPO". This sounds fantastic given the tight privacy headcount budgets etc. However, let’s not forget that this DPO must also have “expert knowledge of data protection law and practices.” How do we do this then? It would be simplistic to think that,  now there is the GDPR which comes as one-law for one-continent,  once you find someone who is a GDPR-expert you can easily appoint him/her as a DPO for your businesses across 10 countries in Europe. Well, this looks more like a regional privacy program manager than a GDPR DPO to me.  As we all know; data protection is an interdisciplinary field influenced by many other areas of law, such as telecoms or employment laws. Therefore national provisions around these or earlier local DPA reflexes to certain privacy topics cannot be ignored. Moreover, now that this new DPO will be the 'face' to local DPAs and citizens; if you have plans to appoint a ‘super- European-DPO’ (s)he will have serious linguistic challenges here. 
    It is another story of course if the DPOs are appointed per country or per similar jurisdiction at the most.
  • comment Sascha Schneider • Jan 11, 2016
    Agree with Gonca here. I think this will need a lot clarification from the Art. 29 WP ... sorry, I meant the European Data Protection Board.
    The Regulation will need a lot of interpretation from local DPAs and Governments to be a fully operational document. It is a tough endeavour to legislate in one country - imagine for 31.
  • comment Jim McNeill • Jan 27, 2016
    It is rather telling, that in the 21st century when almost all information processing is carried out using ICT, that expertise in ICT forms no part of the DPO specification. How is someone without ICT skills supposed to assess appropriate encryption or pseudonmysation practices, the privacy impact of backup strategies, security and access of personal information workflows in particular applications, or the vulnerability of particular data transfers? These are not activities that can normally be reliably contracted out for the heterogenous spread of systems present in any sizeable organisation these days.
  • comment Giulio di Lernia • Nov 23, 2016
    I fully agree with Jim's analysis on the DPO skillset: This figure should be an hybrid one: Either a lawyer with ICT and InfoSec experience, or a Security Professional with a legal background (a CIPP certfication, as a minimum). Probably the third way is the best solution: a DPO in my view should be a Lawyer versed in Data Privacy Law(s) who is tasked to direct InfoSec, IT Risk, IT Compliance and IT Audit resources. Those resources should held at least a CIPP level. The governance below the DPO should be arranged so that those resources are reporting into the DPO directly, and eventually assigned to help out with other tasks in other Departments, just if/when under-utilized.
  • comment JUHAR JALALLE MUTELLIB • Jun 11, 2020
    I suggest that this very important and helpful to protect information .