What Article 38 GDPR requires for the DPO position
If you have already designated a data protection officer, the question a supervisory authority will ask is whether the role is real. Article 38 requires that the DPO be involved properly and in time in all data protection issues, that the DPO receives the resources and access to personal data and processing operations needed to do the job, that the DPO works without instructions on how to perform their tasks and cannot be dismissed or penalised for doing them, and that the DPO reports directly to the highest management level. It also requires that any other duties the DPO holds do not create a conflict of interests. Those four parts are what you need to be able to show. Timely involvement means the DPO sees projects, system changes, vendor selections and incident decisions while options are still open, not after design is locked. Resources and access mean a documented budget line, time allocated in the role description, access to the record of processing, system inventories, data flow diagrams and logs, and a route to ask for information from engineering. Independence means the DPO's advice is recorded, and that when the organization decides against it, the reasons are written down and the DPO's position is visible to the highest management level. Direct reporting should appear in the governance structure and minutes, not only in an organization chart.
Avoiding conflicts is the part most often gotten wrong. The Article 29 Working Party guidance (WP243 rev.01) lists roles that usually conflict with the DPO role, including chief executive, chief operating, chief financial and chief medical officers, heads of marketing, human resources or IT, and other roles that set the purposes and means of processing. A DPO who also runs the security or IT function is reviewing their own decisions. Confirm, in writing, which other duties the person holds and whether any of them determine how personal data is processed. The risk is practical. A DPO who is overruled without a record, has no budget or system access, or is also the person deciding how data is processed cannot warn the organization in time, and the failure usually surfaces during a breach or a regulator inquiry. Because the GDPR requires no audit or certificate for this position, supervisory authorities judge the arrangement from the evidence you hold: appointment letters, reporting lines, meeting minutes, budget records and conflict assessments. Gather that evidence now, before anyone asks for it.
Which teams, systems and roles Article 38 reaches
Article 38 binds controllers and processors, not one department, so the first scoping job is listing every entity and processing operation the DPO must be involved in. The cards below cover the parties, systems, internal roles and workload decisions that determine whether the DPO can actually be involved in time and stay free of conflicts.
Controllers and processors in scope
Article 38 places the duties on the controller and the processor, so every legal entity that determines purposes and means, or processes on another's behalf, must give the DPO support. Group structures often hide this: a parent may designate the DPO while subsidiaries run their own HR, payroll or hosting. Check which entities process personal data, which of them are controllers or processors, and whether each one has a route to the DPO for its own processing.
Systems and processing the DPO must reach
The DPO needs access to personal data and to the processing operations that use it, which means access to records of processing, data flow diagrams, system owners and the datasets themselves. Access requests that pass through several ticket queues delay advice and weaken it. Map the systems that hold personal data, name an owner for each, and confirm the DPO can review configuration, logs and vendor contracts without asking for a change each time.
Roles that set purposes and means
WP243 rev.01 identifies positions that usually conflict with the DPO role, including chief executive, chief operating, chief financial and chief medical officers, and heads of marketing, human resources or IT. The test is functional: any role that decides why data is processed or how the processing is built is a risk. Record each senior role, the processing decisions it makes, and whether the DPO can be appointed from or into it without a conflict.
Platform and security leads
Heads of IT, platform engineering and security often decide how systems store, encrypt, log and delete personal data, so they frequently sit inside the conflict zone. That does not bar the DPO from advising them, but it does mean the DPO should not be the person who designs or signs off the controls they later assess. Document who designs each control, who approves it and who the DPO reviews it for, and keep those roles separate.
DPO with other duties
Article 38(6) allows a DPO to hold other tasks if they do not create a conflict of interests, so a DPO who also runs compliance, legal or security work must be reviewed on each added duty. The review should ask whether the other role sets processing purposes or means, and whether the DPO would be assessing their own decisions. Record the outcome in writing, and revisit it when the other role or the processing changes.
Workload and time allocation
A DPO with a heavy operational role may not have the time to be involved in projects early, which is itself a compliance gap under Article 38(1). Ask how much of the DPO's time goes to each duty, who decides when project reviews are needed, and whether the DPO receives early notice of new systems, vendors and product changes. Written allocation and escalation paths make this checkable at audit or inspection.
How a supervisory authority tests the DPO position
This table sets out, for each element of Article 38, how an authority usually approaches the test, what evidence it asks the organization to produce and the findings that recur in practice. Read it as a preparation checklist: each row names the document or record that should already exist before an inspection starts.
| Test area | What the authority checks | Evidence typically requested | Findings that recur |
|---|---|---|---|
| Timely involvement | Whether the DPO sees data protection questions early enough to influence the outcome, such as new processing, DPIAs and breach decisions | Meeting minutes, project gate sign-offs, DPIA workflow records showing DPO input dates, breach response logs | DPO consulted only after a design is final, or copied on decisions without a documented opinion |
| Resources and access | Whether the DPO has the time, staff, budget and tools to do the job, and can reach personal data and processing operations | Budget records, role allocation or time estimates, access grants to systems and records of processing, training records | No budget line, DPO role added to an existing full-time job with no time allowance, access requests that stall |
| Independence from instructions | Whether anyone directs how the DPO performs tasks, including what conclusions to reach on a matter | Written mandate or terms of reference, correspondence on contested advice, records of how DPO opinions were handled | Management overriding DPO advice without recorded reasons, performance objectives tied to compliance outcomes |
| Protection from dismissal or penalty | Whether the DPO has been removed, disciplined or disadvantaged for performing duties | Employment contract or service agreement, HR records of changes to role or pay, the rationale for any change in status | No documented grounds for changes to the DPO's role, unexplained reassignments after an unpopular opinion |
| Reporting line | Whether the DPO reports directly to the highest management level and has a channel to the board or equivalent body | Organization chart, board or executive committee agendas and papers, annual DPO reports to top management | DPO reports to a mid-level manager who controls the agenda, no record of direct reporting to senior management |
| Conflicts of interest | Whether other duties, such as roles that set purposes and means of processing, undermine the DPO's ability to act independently | Job descriptions, conflict assessments, register of other roles, sign-off on any dual-role arrangement | DPO also serving as head of IT, HR, marketing or a chief officer, with no conflict assessment on file |
| Contact by data subjects | Whether individuals can reach the DPO on processing and rights matters, and whether contact is handled properly | Published contact details in privacy notices, request logs showing DPO involvement, response records | Contact details missing or outdated, requests routed away from the DPO without record |
Steps to put the DPO position in place
This sequence turns the Article 38 requirements into working arrangements: a reporting line that reaches top management, resources and access the DPO can rely on, a written mandate, a conflicts review, involvement triggers in change work, and a scheduled review. Each step ends with a record that an assessor or supervisory authority could inspect.
Confirm the reporting line to top management
Confirm who the DPO reports to and that this reaches the highest management level of the organization, such as the board or chief executive. The organization's leadership makes the decision, and the DPO and legal function usually draft the proposal. Close the step with a board or executive minute that names the reporting line, the frequency of direct reporting and the escalation path when the DPO disagrees with a business decision. Confirm the wording with counsel, because the expected arrangement depends on how the organization is governed.
Set the resource and access baseline
List what the DPO needs to do the job: staff or budget for monitoring and training, time allocation, access to records of processing, system inventories, contracts, DPIAs and incident logs, and access to the personal data and processing operations under review. Compare the list with what the DPO currently receives. Close the step with a signed baseline that states resources, system access rights and the approval route for access requests, so the DPO does not depend on informal goodwill.
Write the DPO role mandate
Draft a written mandate that sets out the tasks, the authority to issue advice and raise concerns, the prohibition on instructions about how tasks are performed, the protection from dismissal or penalty for performing them, and the direct reporting line. The DPO and the executive sponsor review the draft, and legal counsel checks it against Article 38. Close the step with an approved mandate, version-controlled and communicated to the business units that depend on the DPO.
Document the conflicts of interest review
Inventory every other task or role held by the DPO, including any role that sets the purposes or means of processing, such as heading IT, marketing, human resources or a executive position. Assess each against the conflict test in the Article 29 Working Party guidance on DPOs (WP243 rev.01), which lists roles such as chief executive, chief financial officer and head of IT as likely conflicts. Close the step with a signed conflicts register that records each role, the decision taken, any safeguards such as removing the DPO from certain decisions, and the reviewer's name and date.
Set involvement triggers in project and change processes
Add DPO involvement points to the processes where data protection issues arise: new projects, procurement of systems or processors, architecture changes, DPIA screening, incident handling and new processing purposes. Define which events require a DPO review and who must send them. Close the step with updated procedures and a tracker in the change or project workflow that shows when the DPO was consulted and what advice was given before the decision was made.
Publish the contact route for data subjects
Confirm that data subjects can reach the DPO on all matters concerning their personal data and the exercise of their rights. Connect the published contact details to the rights request intake and the privacy notice, and confirm that requests routed to the DPO get logged and answered. Close the step with a tested contact route and a log showing that requests reached the DPO and were handled under the documented process.
Schedule periodic review of the arrangement
Set a recurring review of the reporting line, resource baseline, mandate, conflicts register and involvement triggers, and record each review. Re-run the conflicts review whenever the DPO takes on a new role or the organization restructures. Close the step with a review calendar, minutes from each review and a change log that an internal auditor or supervisory authority could examine.
How to involve the DPO early enough to matter
Timely involvement means the DPO sees a proposal while it can still change, not after the design, vendor or contract is fixed. Article 38(1) requires the controller and processor to involve the DPO properly and in a timely manner in all issues relating to the protection of personal data. In practice that means a named DPO touchpoint in each workflow that can introduce or alter personal data processing: product intake, vendor selection, change approval and incident response. Consultation that arrives once the decision is made is weak evidence, because it shows the DPO was informed rather than able to influence the outcome. An assessor reading the record will ask whether the advice could have changed the design.
Systems can make that timing visible. In product and change workflows, a ticket template can carry a mandatory field stating whether the change adds, removes or moves personal data, and a sign-off gate can block release until the DPO's recorded input or a documented decision to proceed is attached. Where a new processing activity may meet the high-risk threshold, the ticket can route to the DPIA process described under Articles 35 and 36. In procurement, the same gate can require a data protection review before a contract or order form is signed. Confirm with your own tooling vendor whether these gates can be configured as blocking steps rather than optional approvals, because an optional approval produces no evidence of the DPO's position.
An authority or auditor will look for the sequence and the reasoning, not just the signature. They will check that the DPO's advice was requested before the decision date, that the timestamp shows the DPO had the relevant documents, that any departure from the advice was recorded with a reason approved by the appropriate management level, and that the same pattern repeats across ticket samples rather than appearing in one flagship project. Retain the ticket history, approval logs and DPIA versions together so the sequence can be reconstructed. Establish these gates before the first sampled change, because a control introduced after an issue is raised is difficult to present as routine.
Evidence that shows the DPO position works
Article 38 is tested through records, not statements. The artifacts below show that the DPO was involved early, had resources and access, reported to the top of the organization, and was not conflicted. Each one needs an owner and a review rhythm so it stays accurate between formal reviews.
Signed mandate with reporting line
The appointment letter or mandate sets out the DPO's tasks, the highest management level the DPO reports to, and the rule that the DPO receives no instructions on how to perform those tasks. Check that the signatory has authority to appoint, that the reporting line matches the organization chart, and that the document names the DPO's contact details as published. Review it when the DPO's role, reporting line or employer changes, and confirm it at least once a year so the text still matches how the role actually works.
Executive and board minutes
Minutes that record the DPO presenting to the board or the executive committee show direct access to the highest management level, which Article 38(3) requires. Look for dated agenda items, the DPO's written reports, and the decisions taken in response, including cases where management overrode a DPO recommendation and the reason was recorded. Keep attendance records alongside the minutes so an assessor can see the reporting relationship in practice.
Budget and staffing records
Article 38(2) expects the controller to provide the resources the DPO needs. Keep an annual budget line for the DPO function, a record of approved staff or external support, and training spend tied to the DPO's tasks. Compare planned against actual spend each quarter. A budget that is approved on paper but never released, or a DPO with no time allocated for the work, is the gap an assessor usually finds first.
Access grants to processing systems
The DPO needs access to personal data and to the processing operations that use it. Maintain a register of the access granted to the DPO and the team, with the system, the access level, the approver, and the business reason. Review these grants with the same cadence as other privileged access, and confirm that access is logged. Access that exists only in a request ticket, or that expired without anyone noticing, does not show the DPO can do the work.
Conflicts of interest assessment
Article 38(6) allows the DPO to hold other duties only where they do not create a conflict of interests. Record each other role the DPO holds and assess it against roles that determine the purposes and means of processing. WP243 rev.01 names chief executive, chief operating, chief financial and chief medical officers, and heads of marketing, human resources or IT as examples of conflicting positions. Repeat the assessment whenever the DPO's duties change and document the safeguards applied.
Workflow records of DPO consultation
Involvement in time is shown by workflow records: change tickets, project gates, DPIA queues and procurement approvals that show when the DPO was consulted and what advice was given. Check that consultation happens before a processing decision is made, not after deployment. Track the time between a trigger event and DPO input, and keep the advice and the business response together so the record shows how advice was weighed.
What the DPO position costs to meet
This table breaks down the cost components of meeting Article 38 in practice, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No figures are given here because the GDPR sets no fee levels and any real number depends on your organization's size, processing volume and sourcing choices. Use the rows to build the scope you put to a quote.
| Cost component | Who is paid or who bears it | One-time or recurring | What drives it up or down |
|---|---|---|---|
| DPO time or salary (internal) | Your organization, through an employee or a dedicated role | Recurring | Processing volume, number of business units, and whether the DPO also holds another role that needs conflict review |
| External or group DPO fee | An outside DPO service provider, paid under a written contract | Recurring | Scope of tasks, number of entities covered, and how often the DPO attends management reporting |
| Resourcing for the DPO (budget, staff, tools) | Your organization, to give the DPO time, staff and systems under Article 38(2) | Recurring, with some one-time setup | How many processing operations the DPO must monitor and whether the DPO has an assistant or a working group |
| Access tooling and logging for the DPO | Your organization, for records, ticketing and audit trails the DPO can read | One-time setup, then recurring licenses or hosting | Whether you buy commercial software or run self-hosted open-source platforms in your own infrastructure, which can reduce license spend |
| Consultation workflow time | Business owners, engineers and the DPO, as projects involve the DPO in time | Recurring | Release cadence, number of new processing activities, and how early intake is set up in project and procurement gates |
| Conflicts of interest review | The DPO and senior management, documented against Article 38(6) | One-time assessment, then periodic review | Changes to the DPO's other duties, reorganizations, and new roles that determine purposes and means of processing |
| Periodic documentation upkeep | The DPO and control owners, for records, reports to the highest management level and policy reviews | Recurring | Number of processing activities, changes in systems and vendors, and frequency of management reporting |
| Quote scope and assessor fees | An independent auditor or supervisory-facing reviewer if you commission one, and an implementation partner if you engage one | One-time or periodic | Written scope, deliverables and timelines; request a quote from written scope, since the GDPR requires no audit or certificate for this position |
Who owns the DPO position and who can help
The organization owns the DPO position in full. Under Article 38, the controller and processor must involve the DPO properly and in time, provide resources and access to personal data and processing operations, and make sure the DPO reports directly to the highest management level. Those obligations sit with the organization, not with any vendor or consultant, so the appointment, reporting line, budget and final decisions must be set internally or through a contract the organization controls.
- Appointment and reporting line: Decide who holds the role, confirm the DPO reports to the highest management level, and record that line in governance documents.
- Budget and staffing: Fund the DPO's time, tools and any assistants so the role can operate without relying on informal favors.
- Access to data and systems: Grant the DPO access to personal data and processing operations, including logs and records needed to monitor compliance.
- Involvement in decisions: Build a process that brings the DPO into projects, DPIAs and incidents at an early stage, and document when that happened.
- Decisions and accountability: Keep the organization responsible for what it decides, including whether to accept a risk the DPO has advised against.
Check that your governance charter names the DPO, the reporting line and the budget owner, and that the board or senior management has seen the arrangement.
An implementation partner can help the organization prepare the systems and evidence that let the DPO work effectively. The partner does not act as the DPO, does not give instructions on the DPO's tasks, and does not decide whether processing is compliant. Its role is technical and documentary: building the records, controls and packs that the organization and its DPO then review. Where independence matters, the partner's scope should be written so that it supports the DPO without taking over the position.
- Workflow records: Set up ticketing or case-management workflows that log when the DPO was consulted, what was advised and what the organization decided.
- Access controls: Configure role-based access so the DPO can see the records and processing information needed, without changing production data.
- Documentation and evidence packs: Assemble copies of policies, processing records, DPIA outputs and logs in a form the DPO and assessors can review.
- Limits on the partner's role: Confirm in the statement of work that the partner will not sign opinions, approve processing or take decisions reserved to the DPO or the organization.
- Independence safeguards: Ensure the partner's staff do not hold roles that determine purposes and means of processing, to avoid a conflict of interests.
Ask the partner to state in writing which tasks it performs and which it explicitly does not perform. Outsourcing the DPO itself is a separate decision covered on another page.
The supervisory authority, or an independent auditor if the organization commissions one, tests the DPO position from the outside. A supervisory authority can examine whether the DPO was involved in time, had resources, reported to senior management and was free from conflicting duties. Auditors can test the same points as part of a wider review. Neither body is part of the organization's own team, and their findings do not come from the implementation partner. Note that the GDPR requires no audit or certificate, so any external review is a choice the organization makes.
- Testing involvement: Reviewers look for records showing the DPO was consulted before decisions were taken, not only after problems arose.
- Testing independence: Reviewers check that the DPO received no instructions on how to perform tasks and was not penalized for doing so.
- Testing conflicts: Reviewers examine whether the DPO also holds a role such as chief executive, IT head or marketing head that determines processing.
- Issuing findings: Only the supervisory authority or the independent auditor issues findings, orders or reports on the position.
- Evidence requested: Expect requests for appointment letters, reporting-line records, meeting minutes and consultation logs.
Confirm with your legal team which supervisory authority oversees your organization and whether any external review is planned.
Where DPO positions usually fall short
Most DPO problems under Article 38 are structural, not personal: the role sits too low in the reporting line, arrives after decisions are made, or carries work that conflicts with it. The cards below cover the gaps assessors and supervisory authorities most often find, and what to change to close each one.
Reporting to a middle manager
Article 38(3) requires the DPO to report directly to the highest management level. When the DPO sits under a legal, IT or operations manager, privacy findings can be filtered before they reach the board. Check the reporting line on the org chart and in the DPO's appointment letter. Close the gap by making the highest management level the documented line, with a standing agenda item where the DPO reports on risks and open issues.
Consulted after decisions are made
Article 38(1) requires the controller and processor to involve the DPO properly and in a timely manner. A DPO who first sees a vendor contract, product launch or data migration once it is signed has no real chance to influence it. Check whether the DPO appears in project intake, procurement and change approval workflows. Close the gap by adding a mandatory DPO sign-off step before design freeze and before any new processor is engaged.
No budget line
Article 38(2) requires the organization to support the DPO with resources and access to personal data and processing operations. A DPO without a budget depends on other departments for tools, training and specialist help, which weakens both monitoring and independence. Check whether the role has its own cost centre and whether the budget covers tooling, training, audits and external advice. Close the gap by agreeing an annual budget with the highest management level and recording it in the governance documents.
DPO also runs IT or marketing
Article 38(6) allows other duties only where they do not create a conflict of interests. Working group WP243 rev.01 names heads of IT, marketing and human resources, along with chief executive, operating, financial and medical officers, as roles that commonly conflict because they decide purposes and means of processing. Check the DPO's job description for any role that sets how personal data is processed. Close the gap by moving those duties to another person and documenting the conflict review.
Instructions on outcomes given in writing
Article 38(3) bars the controller from giving the DPO instructions on how to exercise their tasks. Written direction that dictates the conclusion of a privacy assessment, such as an instruction to approve a processing activity, undermines that independence even when it is well meant. Check email, tickets and steering committee minutes for directions that prescribe findings. Close the gap by limiting written direction to scope, priorities and resources, and by recording the DPO's own advice alongside any management decision that departs from it.
No record of dismissal safeguards
Article 38(3) states that the DPO must not be dismissed or penalised for performing their tasks. Without a written record of this protection, the safeguard exists only as a principle, and a difficult opinion can later be read as a performance problem. Check the employment contract or service agreement for explicit wording, and check whether any performance review or pay decision cites privacy advice. Close the gap by documenting the protection, requiring the highest management level to approve any dismissal or sanction, and keeping the reasons on file.
Questions buyers ask about the DPO position
Does Article 38 require a certificate for the data protection officer?
No. Article 38 sets out how the position must be placed and resourced inside the organization, and the GDPR does not require an audit, attestation or certificate for it. Certification under Article 42 is voluntary, is issued for at most three years by accredited certification bodies or supervisory authorities, and does not reduce the controller's or processor's responsibility for compliance. A DPO who holds a professional credential has not satisfied Article 38 by holding it. The test is whether the organization involves the DPO in time, gives the DPO resources and access to data, keeps the role free of instructions and conflicts, and reports to the highest management level. Ask any certification provider to explain in writing what their scheme does and does not cover before you rely on it.
How much time does the DPO role take in practice?
The GDPR does not set a number of hours, and no supplied source gives a standard time commitment, so treat any figure you read elsewhere with caution. The workload depends on the volume and risk of processing, how many systems and vendors handle personal data, the number of DPIAs and data subject requests, the number of supervisory authorities you deal with, and whether the DPO also holds another role. Article 38(6) allows other tasks only where they do not create a conflict of interests, so the time left for DPO work is part of the design. Ask the organization to document the expected allocation in the DPO's role description, and confirm the assumptions with the relevant supervisory authority's guidance or with your own risk assessment.
Can an organization appoint and run the DPO function without outside help?
Yes, where the organization has an internal person with the required expertise, a position that can meet the independence rules, and enough time and budget. Many organizations cannot meet all of these at once, especially when the internal candidate is already head of IT, security or marketing, because those roles may create a conflict under Article 38(6). In those cases an external DPO service or a group DPO can be an option, subject to the same rules on independence, access and reporting. Whatever model you choose, the organization remains responsible for compliance. Outside parties can prepare evidence and systems, but only the organization owns its controls.
When should an organization bring in outside help for the DPO position?
Consider outside help when the internal role cannot meet the Article 38 tests, when the volume of DPIAs, data subject requests or vendor reviews exceeds the time available, when a cross-border incident needs specialist support, or when no suitable internal candidate exists. Outside help is most useful when the scope is written down before work starts: which tasks are covered, which systems and vendors are in scope, what reporting line applies, and what evidence the organization keeps. Fixed-scope engagements make the division of work clear. DeployOpen prepares systems, documentation and technical evidence for data protection work inside your own infrastructure. It does not act as your DPO, and it does not issue reports or certificates.
What does the DPO need from senior management to work effectively?
Article 38 expects management to involve the DPO properly and in time, provide resources and access to personal data and processing operations, and ensure the DPO reports directly to the highest management level. In practice this means the DPO is invited to project design reviews and procurement decisions before they close, has a budget line for tools, training and external advice, can open and track issues independently, and is not told how to reach a conclusion on a data protection question. Ask management to confirm these points in a written mandate. A mandate that exists only in a job advertisement is hard to defend when a supervisory authority asks how the role works.
How does an organization identify a conflict of interests for the DPO?
A conflict exists when the DPO's other duties would lead them to determine the purposes or means of processing, or to report on decisions they made themselves. Article 38(6) prohibits such conflicts, and the Article 29 Working Party guidelines (WP243 rev.01) list example positions, including chief executive, chief operating, chief financial and chief medical officers, and heads of marketing, human resources or IT. Identify conflicts by listing every role the candidate holds, mapping each to the processing they decide, and recording the result in a conflict register that is reviewed when roles change. Where a conflict cannot be removed, the role must be redesigned or filled by someone else. Confirm your analysis against the guidelines and, where needed, with your supervisory authority.
What happens if the organization gets the DPO position wrong?
The GDPR sets administrative fines of up to EUR 10 million or 2% of total worldwide annual turnover for infringements such as Articles 25 to 39, whichever is higher, according to Article 83. Article 38 sits within that range, so weak DPO arrangements can contribute to a finding against the organization. Regulators also look at whether the DPO was actually able to act, for example whether their advice was recorded and followed or overruled without reasons. Keep minutes, decision logs and written responses to DPO advice so the organization can show how the role worked in practice. Confirm the penalty exposure for your own sector and jurisdiction with counsel.
How enforcement and pending changes affect the DPO position
Article 38 failures are fined under the lower tier of Article 83, but the DPO position is judged in the context of the whole regime. Article 83 sets two maximum fine levels: EUR 10 million or 2% of total worldwide annual turnover for infringements such as Articles 25 to 39, and EUR 20 million or 4% for infringements of the principles, lawful basis, data subject rights and transfer rules, whichever is higher in each case. The DPO provisions sit in the lower tier, so a supervisory authority reviewing a DPO that was dismissed for raising concerns, or that was kept out of a DPIA, would assess it against that lower ceiling. Enforcement is national: each independent supervisory authority under Article 51 decides its own cases, and the European Data Protection Board established by Article 68 issues guidelines and resolves disputes between authorities through binding decisions. The EDPB guidance on DPOs, including WP243 rev.01, is the reference most authorities cite.
Regulation (EU) 2025/2518 adds procedural rules for complaints and investigations in cross-border cases and applies from 2 April 2027. It does not change the substance of Article 38. Organizations that run one DPO across several Member States should plan for how a cross-border investigation would request DPO records, meeting minutes and evidence of involvement, and confirm which authority would lead. As of October 2026, the GDPR text has not been amended. The Omnibus IV proposal (COM(2025) 501) has a text agreed in interinstitutional negotiations on 26 June 2026 and awaits Parliament's first-reading vote, and the Digital Omnibus proposal (COM(2025) 837) awaits committee decision. Neither has changed Article 38 yet, but both could alter related duties.
Before relying on any of this, confirm the current status on EUR-Lex and in the Legislative Observatory procedure files for Omnibus IV and the Digital Omnibus. Record the date of your check and the version of the text you relied on. Ask your DPO and legal counsel to review whether any proposal would change reporting lines, resourcing or dismissal protection, and budget for that review as a recurring item, since pending proposals can move between readings.
How the DPO position is scoped for implementation
DeployOpen scopes Article 38 work as a fixed written engagement that prepares the systems, access paths and records the data protection officer needs to do the job. The scope starts with a review of the systems and workflows where personal data is processed, including how data protection issues currently reach the DPO. The question to answer is whether the DPO is involved before a new processing activity, system change or vendor onboarding is decided, not after. The review produces a map of the points where the DPO should be consulted, the people who must notify the DPO, and the forums where the DPO's views are recorded.
The second part of the scope covers access and logging for the DPO. The DPO needs access to personal data and processing operations to monitor compliance, so DeployOpen designs a read-oriented role in the self-hosted platforms, separate from operational administration, and agrees with the client which records, configuration and processing logs that role can view. Access reviews, logging of the DPO's own queries and approval paths for any elevated access are defined in the scope so that the DPO's independence can be shown in the system records. Whether the role should include any write permission, and who approves it, is a decision the organization must make and document before implementation starts.
The final part is documentation, evidence packs and handover. DeployOpen assembles the records that show the DPO's involvement and resourcing, such as escalation procedures, meeting minutes, reporting lines to the highest management level and the list of other tasks the DPO holds, so the organization can test for conflicts of interest. Handover covers the runbooks, access matrices and evidence index, and the client confirms the final scope in writing. DeployOpen does not act as the DPO, does not decide whether a conflict exists, and does not issue any report or certificate. Those judgments and any assessment sit with the controller's own management and an independent assessor, which the client should confirm early in planning.
How DeployOpen prepares DPO position evidence
DeployOpen works on the Article 38 position of the data protection officer by preparing the systems, access paths and written records that show the DPO is involved in time, resourced and free from conflicting roles. The organization owns its DPO appointment and decisions, and an independent auditor or certification body issues any report, since the GDPR requires no audit or certificate.
How we scope
- The written scope lists which processing systems, tickets and approval workflows the DPO must be able to see and join.
- We map the DPO's reporting line and any other roles held by the same person, so conflicts are documented before work starts.
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before any work begins.
How we build
- We configure DPO access to records of processing, DPIA registers and incident queues with role-based permissions and logged access.
- We set up notification routes so the DPO receives data protection issues during design and change reviews, not after release.
- We help the organization record DPO resource allocation and escalation paths in a form that an assessor can trace.
How we hand over
- You receive documentation of the DPO access model, approval workflows, escalation paths and conflict-of-interest register.
- Evidence logs show when the DPO was consulted, what they were given and which decisions they reviewed, mapped to the position requirements.
- Handover includes a walkthrough with your DPO, legal and IT owners so the position evidence can be maintained internally.
How we support
- Ongoing support, upgrades and periodic reviews of DPO access and escalation settings are available as a retainer.
- We can rerun access reviews and update the conflict-of-interest record when roles, reporting lines or systems change.
- Confirm with your legal counsel or supervisory authority guidance how the position requirements apply to your sector and Member State.
