What does a DPO do and when is it mandatory?

What is a Data Protection Officer?

A Data Protection Officer (DPO) is an independent official who oversees compliance with the General Data Protection Regulation (GDPR) within an organization. The role is defined in articles 37 through 39 of the GDPR and has been applicable in all EU member states since May 25, 2018.

The DPO is not in the management hierarchy but reports directly to the highest governing body of the organization. This is no accident: the GDPR requires that the DPO be completely independent in performing their duties. The officer cannot be dismissed or disadvantaged because of performing their duties. In practice, this means the DPO must also be able to provide negative advice without career risk.

When is a DPO legally mandatory?

The GDPR (Article 37) mandates appointing a DPO in three situations:

The term "large scale" is not exactly defined in the GDPR. The European Data Protection Board (EDPB) considers factors such as the number of affected persons, the geographic scope, the duration and frequency of processing, and the volume of data processed. A medical practice maintaining health records of its own patients probably does not need to appoint a DPO; a hospital chain processing millions of patient records certainly must.

When is a DPO strongly recommended?

Beyond legal requirements, a DPO is strongly recommended for any organization that processes substantial personal data. The Data Protection Authority advises appointing a DPO when an organization:

The core tasks of a DPO

The GDPR (Article 39) explicitly describes the core tasks of a DPO:

Inform and advise: The DPO informs and advises the organization, its staff and management about their obligations under the GDPR and other privacy legislation. This includes providing legal advice on new processing activities, marketing campaigns, systems and contracts.

Monitor compliance: The DPO monitors GDPR compliance, including overseeing tasks, staff awareness and training, and conducting audits.

Advice on DPIAs: The DPO advises on the conduct of Data Protection Impact Assessments (DPIAs) and monitors their implementation. A DPIA is mandatory for processing that is likely to pose a high risk to data subjects.

Contact point for the authority: The DPO is the contact point for the Data Protection Authority. All formal communication with the supervisory authority goes through the DPO. This also includes cooperation in investigations and responding to authority inquiries.

Handle data subject requests: The DPO coordinates handling requests from individuals exercising their rights: access, rectification, deletion, restriction of processing, portability and objection. Organizations must respond to such requests within one month.

DPO requirements: education and certification

The GDPR sets no formal educational requirements for a DPO but requires "expertise in the law and practice concerning data protection" and knowledge of the organization's operational sector. In practice, two certifications are considered the gold standard:

In addition to legal knowledge, an effective DPO also needs practical skills: stakeholder management, the ability to explain complex matters in understandable terms to non-experts, and organizational insight to embed compliance in daily processes.

Registration with the Data Protection Authority

Organizations for which a DPO is mandatory are legally required to register the DPO's name and contact details with the Data Protection Authority. This applies to both internal and external DPOs. Registration is simple via the authority's portal. The DPO's contact details must also be made public—on the organization's website and in the privacy statement.

Internal versus external DPO: what fits your organization?

An internal DPO is an employee of the organization. Advantages: familiarity with the organization, quick availability, involvement in daily decision-making. Disadvantages: the GDPR requirement for independence can create tensions, replacement during illness or departure is difficult, and broad expertise is expensive for a full-time position.

An external DPO is a certified specialist who fulfills the DPO role on a part-time basis for multiple clients. This offers structural advantages: no hiring costs for a full-time role, immediate availability of specialist expertise, no conflicting interests with internal career concerns, and easier replacement. For SME organizations, external DPO services are virtually always the practical and cost-effective choice.

iso2700x.com offers external DPO services for organizations that need a certified DPO but do not have the need or size for a full-time internal appointment. Our DPOs are CIPP/E certified and combine privacy expertise with deep knowledge of information security—a combination that is rare and valuable in the market.

DPO-as-a-service: what does it entail?

In an external DPO-as-a-service arrangement, iso2700x.com formally fulfills the DPO role for your organization. Specifically, this means: periodic advisory meetings, oversight of the processing register, assessment of new processing activities and vendor contracts, coordination of DPIAs, staff training, handling of data subject requests, and serving as the contact point for the authority. We adjust the service level to match the scope and risk profile of your processing.

DPOFGAVGGDPRPrivacy