# GDPR data protection officer: designation and duties checklist

Use this to decide whether an organization must designate a data protection officer under the GDPR, and to
check that the role is set up the way the Regulation requires. Article numbers are from Regulation (EU)
2016/679. It is a planning aid, not legal advice; national law can add cases where a DPO is mandatory.

## Must you designate a DPO? (Article 37(1))

- [ ] Processing is carried out by a public authority or body (other than courts acting in their judicial capacity)
- [ ] Core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale
- [ ] Core activities consist of large-scale processing of special categories of data (Article 9) or criminal
      convictions and offences data (Article 10)
- [ ] Union or Member State law requires a DPO in your case (Article 37(4))
- [ ] None of the above: you may still designate one voluntarily (Article 37(4))

## Setting up the role

- [ ] Chosen for professional qualities and expert knowledge of data protection law and practice (Article 37(5))
- [ ] Staff member or service contract (Article 37(6)); one DPO for a group only if easily accessible from each establishment (Article 37(2))
- [ ] Contact details published and communicated to the supervisory authority (Article 37(7))
- [ ] Involved properly and in a timely manner in all data protection issues (Article 38(1))
- [ ] Resources, access to personal data and processing, and support to maintain expert knowledge (Article 38(2))
- [ ] No instructions on how to carry out the tasks; not dismissed or penalized for doing them (Article 38(3))
- [ ] Reports directly to the highest management level (Article 38(3))
- [ ] Other duties do not create a conflict of interests (Article 38(6))

## The minimum tasks (Article 39(1))

- [ ] Inform and advise the controller or processor and employees of their obligations
- [ ] Monitor compliance, including assignment of responsibilities, awareness-raising, training and audits
- [ ] Advise on data protection impact assessments and monitor their performance (Article 35)
- [ ] Cooperate with the supervisory authority
- [ ] Act as the authority's contact point, including for prior consultation (Article 36)