Article 37 Designation of the data protection officer
The three cases where a DPO is mandatory, what core activities, large scale and regular and systematic monitoring mean, group and external DPOs, and publishing the DPO's contact details.
Data protection officer
GDPR Articles 37 to 39: when a data protection officer must be designated, the independence and resources the role requires, conflicts of interest, and the minimum tasks.
Article 38 Position of the data protection officer
Involving the DPO properly and in time, resources and access to data, independence from instructions, protection from dismissal, reporting to the highest management level, and avoiding conflicts of interest.
Article 39 Tasks of the data protection officer
The DPO's minimum tasks: informing and advising, monitoring compliance including training and audits, advising on DPIAs, and acting as contact point for the supervisory authority, with a risk-based approach.
