When does GDPR Article 37 require a data protection officer?
Article 37(1) makes a data protection officer mandatory in three situations: when the controller or processor is a public authority or body (courts acting in their judicial capacity excepted), when core activities consist of regular and systematic monitoring of data subjects on a large scale, or when core activities consist of large-scale processing of special category or criminal offence data. If none applies, the organization still has to record a documented decision that it is not required to appoint one. Compliance leads and CISOs should treat that analysis as a deliverable in its own right, because a regulator will ask for it. The risk of getting this wrong is practical: without a designated DPO there is often no accountable privacy function, no owner for DPIAs or regulator contact, and the contact details that Article 37(7) requires to be published may be missing from privacy notices.
The hard part is judgment. The GDPR does not define core activities or large scale with numbers, so organizations have to interpret them. The Article 29 Working Party guidance (WP243 rev.01) recommends weighing the number of data subjects, the volume or range of data, the duration of processing and its geographic extent, and it gives examples of monitoring such as profiling for fraud prevention, location tracking through apps, loyalty programs and CCTV. Two organizations with similar systems can reach different answers depending on how they describe their business model, so the reasoning should be written down, reviewed when products or markets change, and checked against the current supervisory authority guidance in each member state where the organization operates.
Confirm three things before deciding. First, list every processing activity that could be a core activity and note whether it involves monitoring or special category data at scale. Second, decide whether the organization is a public body under national law. Third, if you appoint a DPO voluntarily, the same Articles 37 to 39 duties apply, so the role needs the same independence and resources. The GDPR requires no audit, attestation or certificate for this decision. Supervisory authorities assess compliance, and the evidence they will expect is your own documented analysis, the published contact details and the record of how the designation was carried out.
Which teams, systems and data trigger the DPO test
Article 37 turns on a handful of scoping decisions rather than company size or headcount. Each card below is one decision or system category that changes whether a data protection officer is mandatory, and what evidence you need to document the answer. The test applies the same way to controllers and processors.
Public authority or public body status
Article 37(1) makes a DPO mandatory for public authorities and bodies, with an exception for courts acting in their judicial capacity. Check whether your organization is established under public law, performs public tasks, or is funded and controlled by a public body, and whether any of your operations fall under that status. Public bodies cannot rely on a volume test, so this question should be answered first. Confirm the answer with counsel and record the reasoning.
Regular and systematic monitoring
Monitoring of data subjects is the most common trigger for private organizations, and it is often missed. Under WP243 rev.01, the examples include operating telecommunications networks, behavioral advertising, profiling for risk scoring or fraud prevention, location tracking by mobile apps, loyalty programs and CCTV. Ask whether monitoring is core to the service or incidental to it, and whether it is ongoing rather than occasional.
Product analytics and marketing systems
Product telemetry, marketing automation, email retargeting and experimentation platforms often build behavioral profiles of individuals across sessions. These systems frequently drive the monitoring question because they run continuously and at scale, even when no one labels them as monitoring. Inventory which tools track identifiable users, how long profiles persist, and whether they feed scoring or targeting. Each system with those characteristics should go into the analysis.
Security telemetry and HR systems
Security logging, endpoint detection, identity analytics and workforce tools can monitor employees and customers continuously. Monitoring employees is still monitoring of data subjects, so HR time tracking, productivity dashboards and access analytics belong in the scope. Check what is collected, who reviews it, and whether the purpose is security, fraud prevention or performance management. The purpose you document will shape the analysis, so align it with the records of processing.
Large-scale special category and criminal data
A DPO is also mandatory where core activities consist of large-scale processing of special category data or criminal offence data. Health records, biometric identifiers used for authentication, and criminal record checks are typical examples. Size is judged by the number of data subjects, the volume or range of data, the duration of processing and its geographic extent. A small team can still meet the threshold if it processes sensitive data for many people over long periods.
Group structures and processor roles
A group of undertakings may appoint one DPO who is easily accessible from each establishment, so the test should be run per legal entity and then consolidated. Processors are subject to the same test for their own processing, such as managing their own staff or marketing, even when they act on customer instructions for other data. Map each entity and its processing role, and confirm which entities hold the designation and where the DPO is reachable.
What core activities, large scale and regular and systematic monitoring mean
Article 37(1) makes a data protection officer mandatory when a controller's or processor's core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of special category or criminal offence data. Article 29 Working Party guidance (WP243 rev.01) treats core activities as the key operations needed to achieve the organization's goals, not the ancillary functions every organization performs, such as paying staff, running IT support or handling facilities. A fraud platform for a payments business or a patient record system for a clinic is core. The payroll system that supports the business is typically not, although it may still involve large-scale processing of special category data that needs its own analysis. Document which processing operations you treated as core and why.
WP243 rev.01 asks you to weigh four factors for large scale: the number of data subjects concerned, the volume or range of data processed, the duration or permanence of the processing, and its geographical extent. No single factor settles the question, and the guidance does not set numerical thresholds. Ask your engineering and data teams for the real counts: how many people are in each dataset, how many fields and categories each record holds, how long records are kept, and which countries the data subjects live in. A regional bank and a national insurer can both meet the test with very different numbers, so the reasoning matters more than any figure.
WP243 rev.01 gives examples of regular and systematic monitoring, including operating telecommunications networks, email retargeting, profiling for risk scoring or fraud prevention, location tracking by mobile apps, loyalty programs, behavioral advertising and CCTV. Regular means ongoing or recurring within a set period, and systematic means occurring according to a system, pre-arranged or organized. Check each system that tracks, scores or profiles people against these terms. Treat the outcome as a documented judgment, not a checkbox: record the factors, the examples you compared against, the people who reviewed the analysis, and the date it was last revisited. WP243 rev.01 also notes that a DPO designated voluntarily is subject to the same Articles 37 to 39 requirements.
How to run the DPO designation analysis and act on it
This sequence turns the Article 37 question into a documented decision. It produces a reasoned designation memo, a chosen DPO model, an appointment record, published contact details and a notice to the supervisory authority.
Inventory processing activities against the triggers
List every processing activity that touches personal data, including activities run by processors on your behalf. For each one, record whether the controller or processor is a public authority or body, whether its core activities involve regular and systematic monitoring of data subjects, and whether its core activities involve large-scale processing of special category or criminal offence data. Assign the work to the privacy lead with input from system owners, since they know where monitoring and sensitive data actually sit. The output is a processing inventory with a trigger column completed for each row, and you know this step is done when every system in the records of processing has a documented answer for all three triggers.
Assess core activities and large scale
For each activity flagged as possibly core, decide whether the monitoring or sensitive processing is central to the business rather than incidental support work. For each activity that looks large scale, score it against the four factors in the Article 29 Working Party guidance: number of data subjects, volume or range of data, duration or permanence, and geographical extent. Examples in that guidance include telecommunications networks, profiling for risk scoring or fraud prevention, location tracking by mobile apps, loyalty programs, behavioral advertising and CCTV. Legal or privacy counsel should review borderline cases. The output is a scored worksheet with a short rationale for every activity, and it is complete when no flagged activity lacks a scored rationale.
Record the designation conclusion with reasoning
Write a designation memo that states whether a DPO is mandatory, which trigger applies and why, and which activities were ruled out and on what basis. The guidance recommends documenting this internal analysis even where the answer is that no DPO is required. Have the memo reviewed by legal counsel and approved by the accountable executive, then sign and date it. The output is a signed designation memo stored with the records of processing. The step is done when a reader outside the project could follow the reasoning from the inventory to the conclusion without asking questions.
Choose the internal, group or external model
If a DPO is required, or if you decide to appoint one voluntarily, select the model. An internal staff member, a single DPO for a group of undertakings that is easily accessible from each establishment, or an external DPO under a service contract are all permitted under Article 37. Weigh expertise, independence from processing decisions, capacity across establishments and language coverage for each option. Ask any external provider to confirm in writing how they will handle conflicts, access to systems and reporting lines. The output is a model decision record listing the chosen option and its rationale, and it is complete when the reporting line and the named individual or firm are agreed.
Appoint the DPO and document the appointment
Issue a written appointment that names the DPO, states the tasks and the reporting line to the highest management level, and confirms the resources provided. Where the DPO is a staff member, confirm the role does not sit with someone who determines the purposes and means of processing. Where the DPO is external or serves a group, record the service contract or group arrangement and the contact arrangements for each establishment. The output is a signed appointment letter or contract held with the designation memo, and the step is done when the appointee has accepted in writing.
Publish the DPO contact details
Publish the DPO's contact details where data subjects and staff can find them, typically in the privacy notice and on the website privacy page. Publish a contact route, such as a role mailbox, rather than only a personal address, so that continuity survives staff changes. The publication must include the contact details themselves, not the DPO's name unless you choose to add it. The output is a live privacy page entry with a screenshot or archived copy retained, and the step is complete when the entry has been checked against the current appointment.
Notify the supervisory authority and keep records
Communicate the DPO's contact details to the competent supervisory authority, using the channel that authority specifies. Keep the submission confirmation or correspondence in the compliance file. Set a review point to recheck the designation analysis when processing changes, such as a new monitoring product, a merger or a shift to large-scale sensitive data, and update the authority if the contact details change. The output is a notification record with the date, channel and confirmation, and the step is done when the file contains proof that the authority received the details.
Group, shared and external DPOs under Article 37
Article 37(2) allows a group of undertakings to appoint a single DPO, provided the DPO is easily accessible from each establishment. Accessibility is practical as well as geographic: the DPO needs to be reachable by staff, by data subjects and by the supervisory authority in each country where the group operates, and in the languages those audiences use. A group DPO spread across many establishments also needs a realistic capacity plan, because the same person or team carries the monitoring and advisory load for every entity.
- Accessibility in practice: Confirm contact routes, working languages and response expectations for each establishment, and publish them consistently.
- Resourcing for scale: Ask whether the DPO has deputies, local contacts or a team sized for the number of entities and processing activities.
- Entity-by-entity records: Keep records of which controllers and processors rely on the shared appointment, since each one remains responsible for compliance.
- Reporting lines: Define how issues from subsidiaries reach group management and how local management responds.
- Conflicts: A group DPO who also runs group IT or security may face a conflict that Article 38 governs, so check role overlap before appointment.
Before relying on a group appointment, confirm in writing that every establishment can actually reach the DPO and that the DPO has the time and authority to act for all of them.
Article 37(6) allows the DPO to be a staff member of the controller or processor. An internal DPO knows the systems, business lines and people well, which helps with ongoing monitoring and day-to-day advice. The trade-off is that a staff DPO is more exposed to conflicts, because most job descriptions involve decisions about processing. The appointment must therefore be designed around the role's independence, not only its title.
- Role separation: Check that the DPO is not the person who decides purposes and means of processing, such as the head of marketing, HR or IT operations.
- Time allocation: Write the time the role requires into the job description and workload plan, so the DPO duties are not absorbed by unrelated work.
- Reporting: Record the reporting line to the highest management level, the route for escalation and the DPO's access to decision-makers.
- Training and continuity: Plan for cover during absence and for skills development in privacy and security.
- Documentation: Keep the internal analysis showing why a DPO was required and how the appointed person was selected.
Confirm that the internal DPO's other duties do not overlap with decisions the DPO would later need to review, and record that analysis before the appointment takes effect.
Article 37(6) also allows the DPO to fulfil the tasks under a service contract, which is the usual route for organizations that want outside expertise or cannot justify a full-time role. An external DPO is not a substitute for organizational responsibility: the controller or processor still owns its processing decisions, and the contract defines what the provider does and what the organization must supply. Contract quality determines whether the arrangement works in practice.
- Defined tasks: List the Article 39 tasks the provider covers, the hours or frequency of involvement and the escalation thresholds.
- Reporting lines: Name who inside the organization receives DPO reports and how they reach the highest management level.
- Access and resources: Specify the documents, systems contacts and internal staff time the provider needs, and who supplies them.
- Independence terms: Address instructions, confidentiality and what happens if the provider is asked to take a position that conflicts with its advice.
- Conflicts and exit: Require disclosure of other clients or roles that create conflicts, and set terms for termination and handover.
Ask the provider how it manages conflicts across its client base and who will personally perform the work. Pricing, effort and duration should come from the written scope, not from general estimates.
Whichever option an organization chooses, Article 37 only decides who may be appointed. Whether that person can act independently is governed by Article 38, which this page does not cover in detail. The practical risk is that a DPO holds a role that effectively sets the purposes or means of processing, or reports to the people whose processing the DPO must review. Designating the DPO on paper does not resolve that conflict.
- Shared roles: Identify combined roles such as IT security lead, CISO, head of HR or marketing director, and treat them as conflict candidates.
- Group and external overlap: Check whether a shared or external DPO also advises other group entities or clients whose interests may diverge.
- Documented analysis: Record the conflict assessment alongside the Article 37 designation decision.
- Review triggers: Reassess when roles change, when a new entity joins the group or when the provider takes on new clients.
- Pointer: See the Article 38 page for independence, resources and reporting requirements.
Before appointment, confirm in writing that the appointed person holds no role that would require them to review their own decisions.
How an assessor tests the DPO designation decision
This table compares six points an assessor or supervisory authority reviews when testing whether a data protection officer was designated correctly. Read each row as a test, the evidence that should exist, and the gap that most often appears in practice.
| Test area | Evidence requested | Common findings |
|---|---|---|
| Documented necessity analysis against the three triggers | Written assessment covering public authority status, core activities under Article 37(1)(b) and (c), and the date and approver of the conclusion | No written analysis exists, or the file only says a DPO is not needed without reasoning |
| Large-scale and monitoring reasoning | Analysis weighing number of data subjects, volume and range of data, duration and geographic extent, plus an inventory of monitoring activities such as profiling, location tracking and CCTV | Analysis ignores a monitoring system, such as fraud scoring, app location features or loyalty tracking, that the organization runs |
| Appointment record and designation where required | Signed designation record, scope of tasks, reporting line, and proof the appointed person meets the professional qualities the role needs | DPO required by the analysis but never appointed, or appointed on paper without a defined role or time allocation |
| Publication of contact details on the public site | Live privacy page or notice showing the DPO contact route, checked against the current appointment | Contact details buried several clicks deep, missing from privacy notices, or pointing to a mailbox nobody monitors |
| Communication of contact details to the supervisory authority | Copy of the notification or registration submitted to the competent authority and its date | Notification never sent, or sent for an earlier DPO who has since left the role |
| Voluntary designations meeting Articles 37 to 39 | Appointment letter confirming the DPO is subject to the same independence, resource and task requirements as a mandatory DPO | Voluntary DPO given tasks without resources or access, so the designation is treated as a title only |
Evidence that shows the designation is correct and current
A DPO designation is only as defensible as the paper behind it. The cards below cover the documents a supervisory authority or auditor would ask for, and the review habits that keep them accurate between assessments. Several of them depend on each other, so a change to one usually means updating another.
Signed necessity analysis
This is the written analysis of whether Article 37 requires a DPO at all, covering the public authority test and the core activities test. WP243 rev.01 recommends documenting it even where the answer is that no DPO is mandatory. Check that it names the processing it relied on, the large scale factors considered (number of data subjects, volume and range of data, duration and geographical extent), and who signed it. Date it, and record the reasoning for any voluntary designation, since a voluntary DPO is subject to the same Articles 37 to 39 requirements.
Appointment letter or service contract
This document records who holds the role, whether they are an employee or an external provider, and the tasks and resources assigned. For a group DPO or an outsourced service contract, it should state how the DPO stays easily accessible from each establishment. Confirm that the scope matches the duties in Article 39 and that it does not assign conflicting roles, such as running marketing or IT operations that set processing purposes. Keep the signed copy with the version history.
Published contact details with a dated snapshot
Article 37(7) requires the organization to publish the DPO's contact details, which is usually done in the privacy notice and on the website. Keep a dated screenshot or archived copy of each published location so you can show what was public on a given date. Check that the contact route reaches a monitored mailbox rather than a named individual who may leave. Compare the published details against the current appointment at each review.
Supervisory authority notification record
Article 37(7) also requires the contact details to be communicated to the supervisory authority. Keep the submission confirmation, the date sent, the authority's reference if one is issued, and the contact details as they were filed. Each time the DPO changes or the contact route moves, file an update and keep the earlier record. Confirm the filing method and format with the authority in each Member State where you operate, since procedures vary.
Processing inventory behind the analysis
The necessity analysis is only as reliable as the inventory it draws on. Keep the register of processing activities that shows which systems process special category or criminal offence data, which perform profiling, fraud scoring, location tracking or behavioral monitoring, and at what scale. Record the inventory date and version, and tie each entry to the analysis it supports. An inventory that is out of date will make the large scale and monitoring conclusions unreliable.
Review log and change triggers
Keep a dated log of each review of the designation, with the reviewer, the outcome and any change made. Set an annual review date and a change trigger tied to new processing activities, new data categories, new countries of operation or a new monitoring feature. Each trigger should open a short re-check of the necessity analysis and the published details. Confirm the trigger list with your legal team, because the thresholds depend on your own processing.
What the Article 37 designation costs in money and effort
This table breaks down the cost components of deciding whether a DPO is required and then running the role, showing who is paid, what recurs and what moves the figure. No fee is published here, and a quote follows from a written scope. The GDPR itself imposes no certification cost because no certificate is required.
| Cost component | One-time or recurring | Cost drivers | How to reduce it |
|---|---|---|---|
| Necessity analysis and legal review | One-time, repeated when processing changes | Number of processing activities, legal counsel hours, whether the analysis is documented | Prepare a clear list of processing activities before counsel review and keep the written analysis on file |
| Processing inventory work feeding the analysis | One-time, then recurring as systems change | Number of systems, data flows and third parties; quality of existing records of processing | Reuse the record of processing and system inventories already maintained for other obligations |
| Internal DPO salary or time | Recurring | Seniority, share of working time allocated, group or multi-entity scope, training needs | Confirm the role's time allocation in writing and avoid assigning tasks that create conflicts of interest |
| External DPO fee under a service contract | Recurring, set by the contract | Scope of tasks, number of establishments, response times, languages and on-site presence | Define tasks, service levels and reporting in the contract so the fee maps to a written scope |
| Publication and supervisory authority notification | One-time setup, with updates when contact details change | Number of establishments and countries, website changes, internal approval steps | Publish a stable role mailbox and update the notification whenever the designated person changes |
| Annual review of the designation | Recurring | Changes in processing, new large-scale activities, reorganizations, mergers | Schedule the review with the processing inventory update so both run together |
Who owns the DPO decision, who prepares the evidence and who assesses it
Your organization owns the decision. Article 37 places the duty to designate a data protection officer on the controller or processor, so the board or the accountable executive must decide whether one of the three mandatory cases applies, approve the analysis, and appoint the DPO. The DPO's role, reporting line and resources also remain internal decisions, even when the DPO is an external service.
- The designation decision: Record whether the organization is a public authority or body, and whether its core activities involve regular and systematic monitoring or large-scale processing of special category or criminal offence data.
- The written analysis: Sign off the internal memo that explains the reasoning, including cases where no DPO is required, since WP243 rev.01 recommends documenting that analysis.
- The appointment: Name the DPO, confirm whether the role is staff or a service contract, and confirm the contact details are published and sent to the supervisory authority.
- The mandate: Set the DPO's tasks, access to data and processing activities, and reporting line to the highest management level.
- Ongoing review: Reassess the designation when processing changes, such as a new monitoring product or a larger customer base.
Check that a named executive can explain the decision to a regulator without relying on a consultant's wording.
An implementation partner prepares the material that supports the decision. DeployOpen plans and implements self-hosted open-source platforms in your own infrastructure and can prepare systems, controls and evidence for a compliance assessment. Preparation does not transfer the decision, and a partner never issues the conclusion on whether your designation is correct.
- Processing inventory: Map which systems process personal data, where they run and which processing operations would be weighed for Article 37.
- Draft analysis memo: Prepare a draft of the designation analysis for your DPO candidate or legal team to review, challenge and adopt.
- Publication and evidence store: Set up a location for the published contact details, the appointment record and the supporting documents, with access controls and retention.
- Readiness review: Walk through the inventory and memo against the Article 37 test and list gaps for your team to resolve.
- Scope boundaries: Agree in writing what the partner will and will not produce, and who signs off each deliverable.
Ask the partner to show which deliverables are drafts for your review and which are final records you adopt.
An outsourced DPO service can supply the individual who performs the tasks, but outsourcing does not transfer the controller's accountability. Article 37(6) allows the DPO to fulfil tasks under a service contract, and a group may use one DPO across establishments if that person is easily accessible from each. The contract defines the role, not the legal responsibility for compliance.
- Contract terms: Specify the tasks, the time commitment, the named individual, independence safeguards and escalation routes in writing.
- Access and resources: Confirm the provider can reach the processing records, systems owners and management needed to do the job.
- Conflicts of interest: Check that the provider does not also set the processing purposes or run the systems being overseen.
- Publication: Make sure the published contact details route to the service and that your organization remains the named controller.
- Exit terms: Plan how the appointment changes if the provider or the individual changes.
Ask whether the contract would let your organization show a regulator who decided, who was appointed and who was accountable.
Supervisory authorities and independent auditors test the outcome. Each national supervisory authority enforces the GDPR under Article 51, and an independent auditor or assessor may review your controls if you commission an assessment. Neither works for your organization, and neither signs off a designation on your behalf. The GDPR requires no audit, attestation or certificate.
- What is tested: Whether a DPO was designated where required, whether the analysis was documented, and whether the contact details were published and communicated.
- Evidence requested: The memo, the processing inventory, the appointment record, the publication page and the notification to the authority.
- Who reaches the conclusion: The authority or assessor forms its own view, and a partner's readiness review does not substitute for it.
- Certification limits: Any Article 42 certification is voluntary and does not reduce the controller's responsibility.
- Enforcement context: Fines under Article 83 can reach the higher of EUR 10 million or 2% of worldwide turnover for infringements of Articles 25 to 39.
Before engaging an assessor, confirm its scope, its independence from your partner and the evidence it expects to see.
Where organizations usually miss the Article 37 test
Most Article 37 failures are not about whether a DPO was appointed. They come from undocumented decisions, incomplete processing inventories and contact details that drift out of date. The cards below cover the gaps we see most often, with the check that closes each one.
No record of the no-DPO decision
An organization that concludes it is not required to appoint a DPO still needs to show how it reached that answer. WP243 rev.01 recommends documenting the internal analysis of whether a DPO is required. Record the processing activities reviewed, the reading of core activities, large scale and monitoring applied to each, and the person who approved the conclusion. Revisit the analysis when new products, markets or data sources are added, because the answer can change without any announcement.
Monitoring left out of the inventory
The trigger in Article 37(1) turns on regular and systematic monitoring of data subjects on a large scale. Teams often treat monitoring as a marketing or security topic and leave it out of the processing inventory used for this analysis. WP243 rev.01 lists examples such as behavioral advertising, profiling for fraud prevention, location tracking by mobile apps and CCTV. Check the inventory against those examples, including analytics SDKs, fraud scoring pipelines and building or vehicle cameras managed by facilities teams.
Contact details without a named role
Article 37(7) requires the controller or processor to publish the DPO's contact details and communicate them to the supervisory authority. A personal mailbox that belongs to someone who has left, or a generic privacy inbox that nobody monitors, fails the test in practice. Publish a role-based address that routes to a named DPO deputy, list it in the privacy notice and the supervisory authority registration, and confirm it is monitored during working hours. Review the entry whenever staff change.
Group DPO not reachable from each establishment
Article 37(2) allows a group of undertakings to appoint a single DPO only if that person is easily accessible from each establishment. A DPO based in one country, with no language coverage or local contact route for other sites, does not meet that test on paper. Map each establishment, confirm the working languages the DPO needs to support, and document how staff and data subjects in each location reach the DPO. Revisit the arrangement after reorganizations or acquisitions.
Voluntary DPO without Article 38 and 39 duties
A DPO appointed voluntarily is still subject to the requirements of Articles 37 to 39, according to WP243 rev.01. Organizations sometimes name a privacy lead in a job description and assume the statutory position applies only when a regulator asks. Set the role's reporting line, resources, independence and minimum tasks in a written appointment or service contract, and confirm the person can access systems and data needed to monitor compliance. Without those terms, the appointment carries the label but not the duties.
Questions buyers ask about Article 37 before hiring help
Do we need a DPO if we are small?
Not necessarily. Company size does not decide it. Article 37(1) requires a DPO in three cases: processing by a public authority or body (other than courts acting in their judicial capacity), core activities that consist of regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special category or criminal offence data. A small firm that profiles customers for fraud scoring, runs CCTV across sites or processes health records at scale can meet the test, while a larger firm with ordinary administrative processing may not. If none of the cases applies, you can still designate a DPO voluntarily. The Article 29 Working Party guidance (WP243 rev.01) says a voluntary DPO is subject to the same Articles 37 to 39 requirements. Document your reasoning either way.
How long does a DPO designation analysis take?
The length depends on how many processing activities you run and how well they are already documented, so no fixed duration applies. Expect the work to start with an inventory of each processing activity, its purpose, data categories, approximate number of data subjects, retention period, geographic reach and any monitoring of individuals. Those inputs map to the factors WP243 rev.01 recommends weighing for large scale: number of data subjects, volume or range of data, duration of processing, and geographical extent. You will need named system owners who can answer for each platform, your existing records of processing if you have them, and a senior decision-maker to approve the outcome. Ask any provider to confirm in writing what they will review, what they will deliver and who signs off the conclusion.
Can a DPO service provider act as our DPO?
Yes. Article 37(6) allows the DPO to fulfil the tasks under a service contract. Whether a particular provider should do so is a separate question. The individual must have the professional qualities and expertise the GDPR expects, must be able to act independently, and must be easy to reach from each establishment. Your organization remains responsible for compliance. Check who the named person is, how much time they commit, how they avoid conflicts with any other work they do for you, and how they report to top management. DeployOpen does not present itself as a DPO service. Its work is planning, implementing and documenting self-hosted open-source platforms, and preparing systems and evidence for compliance assessments under a fixed scope agreed in writing. Keep the DPO function separate from that technical preparation work and confirm the division of duties in the contract.
Does our DPO need to be a lawyer?
No. The GDPR does not require a law degree or bar membership. Article 37(5) ties the designation to professional qualities and expert knowledge of data protection law and practice, and to the ability to perform the tasks in Article 39. In practice, that means someone who understands the regulation well enough to advise on lawful bases, data subject requests, DPIAs and breach decisions, and who understands how your systems handle personal data. Legal training helps, but a technically literate privacy professional can meet the standard with the right knowledge, training and time. You may still need counsel for contract and enforcement questions. Record how the chosen person meets the expertise test, including their training and experience, so that an assessor can see the basis for the appointment.
Can we appoint a DPO and still be non-compliant?
Yes. Appointing a DPO is one obligation among many, and it does not transfer responsibility for the processing. The controller or processor remains accountable. Common failures include a DPO without the time or resources to do the job, a DPO who receives instructions on how to carry out tasks, a DPO who also decides the purposes and means of processing, contact details that are not published or not sent to the supervisory authority, and a DPO left out of DPIAs and breach decisions. Infringements of Articles 25 to 39 fall in the tier that carries fines of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, under Article 83. Ask your counsel or auditor to test the designation against Articles 37 to 39, and keep dated records of the appointment, reporting lines and the DPO's involvement.
What does a partner do that we cannot do ourselves?
A partner can carry out the technical and documentary groundwork that your DPO and assessors depend on, and much of it can be done in-house if you have the capacity. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. It also prepares systems, controls and evidence for compliance assessments, and runs security testing and compliance readiness work. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that scope. What a partner cannot do is hold your legal position or issue an audit report. Your organization owns its controls and its DPO appointment, and only an independent auditor or certification body issues reports or certificates.
How DeployOpen supports the DPO designation evidence
DeployOpen plans, implements and documents the systems and records that support a designation decision under Article 37. In practice this means a processing inventory that shows where personal data is handled and at what scale, a map of the systems that observe or profile individuals (for example, fraud scoring, location features or CCTV integrations), a publication workflow for the DPO's contact details, and an evidence store where the internal analysis and its supporting records are kept. All of it is built and hosted inside the client's own cloud accounts, data centers or air-gapped networks, so the organization keeps direct control over the material a supervisory authority may ask to see. Organizations that already run a record of processing can ask DeployOpen to extend it with the fields needed to answer the large-scale and monitoring questions.
DeployOpen does not act as the DPO, does not make the legal determination of whether a DPO is required, and does not issue audit reports, attestations or certificates. The GDPR requires no certificate for designation, and the decision remains the controller's or processor's. An independent auditor or counsel may review the result, but that review is their work, not DeployOpen's. The reader should confirm internally who signs off the designation analysis and who maintains the published contact details after the engagement ends.
Each engagement is fixed in scope. Before work starts, the parties agree in writing which systems, data sources, records and publication channels are included, what each deliverable contains, and who on the client side approves each one. Ask for the written scope to name the owner of the designation analysis, the systems in the inventory, and the handover items the organization keeps. Ongoing review of the analysis as processing changes can be handled under a separate retainer if the client wants it.
