How to Provide DPO Contact Information to Your DPA

Article 37(7) of the European Union’s new General Data Protection Regulation requires that “the controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.” But how does one go about communicating this information to relevant authority? Is there a formal process, or can companies simply send an email with a DPO’s name, phone number and email address? As it turns out, different jurisdictions have settled on different notification mechanisms. With the assistance of Bird & Bird, the IAPP has compiled a list of each country’s requested DPO notification process.

Country Additional local DPO obligation? Preferred method or procedure for DPO communication Guidance

Austria No. No formal requirement.
Email with the DPO's contact details is sufficient.
The Austrian DPA links to the Working Party guidance; here.

Belgium No. Online form available here. Guidelines (in Dutch and in French)

Bulgaria No. Communication may be accomplished personally, by letter, or by email. The Bulgarian Commission for Personal Data Protection offers a sample form and details for each method online. Guidelines (in Bulgarian)

Croatia No. Yes- DPO information must be delivered in writing to the Croatian DPA’s headquarters; the form is available on the DPA’s website. Brief guidance is available on the website, along with a link to the Working Party’s documents. 

Cyprus No. No formal process listed. Available via website; the DPA links both the Working Party guidance and it’s own FAQ (Cypriot Greek)

Czech Republic No. No formal process, DPA website (available in Czech) suggests that notification to the DPA via email is acceptable. Guidelines (in Czech)FAQs (in Czech)

Denmark No. No formal process listed. Guidelines (in Danish)

Estonia No. Yes – Via the Estonian Data Protection Inspectorate’s enterprise portal. Email to the local Data Protection Board is also permitted.  Guidelines (in Estonian)

Finland No. DPA has published an online form. (Available in Finnish) Guidelines & FAQ (in Finnish)

 France No. The CNIL has published an online form. (available in French)  Guidance (in French)

Germany Yes, for organizations that employ at least 10 people involved in automated processing of personal data. DPO is not required to be based in Germany. DPA of federal government has implemented an online notification system (for public agencies of federal government, providers of postal and telecommunications services only). Guidelines (in German)
 
Baden-Württemberg   Has published an online form.  
 
Bavaria   Will publish an online form by 31 August, 2018.  
 
Berlin   Has published an online form.  
 
Bremen   Has not yet released a process.  
 
Hamburg   Has published an online form, which may be submitted by post, fax, or email.  
 
Hessen   Has implemented an online notification system.  
 
Mecklenburg-Vorpommern   Has implemented an online notification system.  
 
Lower Saxony   Has not yet released a process.  
 
Nordrhein-Westfalen   Has implemented an online notification system (sign-in required).  
 
Rheinland-Pfalz   Has implemented an online notification system.  
 
Saarland   Has implemented an online notification system.  
 
Sachsen   Has published an online form and implemented an online notification system. Either option is acceptable; printed forms must be mailed to the Saxon Data Protection Supervisor.  
 
Sachsen-Anhalt   Has implemented an online notification system.  
 
Schleswig-Holstein   Has implemented an online notification system.  
 
Thuringia   Has published an online form.  

Greece No. DPA has published an online form. (Available in Greek).  None.

Hungary No. The DPA is in the process of implementing a dedicated online notification system; in the interim documents can be filed with NAIH via email. Summary of the role (in Hungarian)
Other NAIH documents are available in Hungarian as well.

Ireland No. DPA has published an online form, which must be emailed to RegisteryourDPO@dataprotection.ie  Guidance (in English).

Italy No. DPA has published a paper form and will create an online notification tool. None available.

Latvia No. No procedure yet; the Data State Inspectorate can be contacted here. None available.

Lithuania No. DPA has created an online notification system. (Available in Lithuanian, requires sign-in). Information may also be provided free-form to DPA via email or post.  None available.

Luxembourg Yes, for scientific/historical research/statistical processing DPA has published an online form. (Available in French). Form should be submitted to declarationDPO@cnpd.lu Guidance (in French).

Malta No. Guidelines include instructions to email the IDPC with the DPO’s information. Contact information and instructions here. The IDPC links to the Article 29 Working Party guidance on DPOs, here

The Netherlands No. DPA has published an online form. (Available in Dutch). Guidelines (in Dutch)

Poland No. Notification via the website. Guidance from Privacy Tracker

Portugal No. Notification form is available through the DPO’s website and must be completed and submitted via email.
An online process is forthcoming.
None available.

Romania No. DPA’s has published an online form. (Automatic download, in Romanian). None available.

Slovakia No. DPA has implemented an online notification system through the regulator’s website.   Forthcoming.

Slovenia No. No formal process; Information Commissioner must be informed of the DPOs name, workplace, e-address and phone number; may be done via its Slovene-language website; the Slovenian DPA has published an optional online form Guidance page (in Slovene)

Spain Yes, for:
⋅ Entities operating electronic communications networks and offering electronic communication services on a large scale.
⋅ Information society service providers carrying out data subject profiling activities on a large scale.
⋅ Entities carrying out advertising and commercial research activities based on the data subjects' preferences or carrying out profiling activities.
DPA has published an online form.
(Data controller must use a Spanish Government-approved electronic signature to notify the DPO)
Guidelines (in Spanish)

Sweden  No. DPA has published a paper form and will also provide an online notification tool after 25 May. Guidelines (in Swedish)

UK No. The ICO has set up an email address to which information should be sent. Contact information and instructions here. Guidelines (in English)