The DPO (Data Protection Officer) is an independent person responsible for overseeing GDPR compliance within an organisation.
What is a DPO?
The Data Protection Officer is a data protection expert who advises the organisation on GDPR matters, monitors compliance with regulations and serves as the contact point for supervisory authorities and data subjects.
When is a DPO mandatory?
The GDPR requires the appointment of a DPO in the following cases:
- Public authorities – All state and public institutions
- Large-scale regular monitoring – Organisations systematically monitoring individuals on a large scale
- Special categories of data – Large-scale processing of sensitive data (health, biometric)
Tasks of the DPO
- Inform and advise on obligations under the GDPR
- Monitor GDPR compliance
- Provide advice on DPIAs (Data Protection Impact Assessments)
- Cooperate with the supervisory authority
- Act as the contact point for the DPA
- Be available to data subjects
Requirements for a DPO
- Expert knowledge of data protection law and practice
- Independence – must not receive instructions regarding the performance of tasks
- Direct reporting to the highest level of management
- Sufficient resources to carry out tasks
DPO and cookies
The DPO should be involved in setting the organisation's cookie strategy, assessing legal bases for different types of cookies and ensuring cookie banner compliance.