Article 39 DPO tasks: requirements and evidence

What Article 39 tasks does a data protection officer have to perform?

A data protection officer must perform at least five tasks under Article 39(1) of the GDPR: inform and advise the organization and its staff, monitor compliance (including the assignment of responsibilities, awareness-raising, training and related audits), advise on and monitor data protection impact assessments, cooperate with the supervisory authority, and act as its contact point. When an auditor, customer or regulator asks how these tasks are performed, the answer should point to a documented schedule, a register of advice given and a dated record of each monitoring activity, not to the DPO's general availability. The DPO performs these tasks, but the controller or processor remains responsible for compliance. Article 39(2) adds that the DPO must weigh the risk of processing operations, taking into account their nature, scope, context and purposes, so the monitoring plan should concentrate on the high-risk systems first.

The work is hard for two recurring reasons. First, the evidence needed to show monitoring is scattered across engineering, HR, procurement and security teams, so the DPO spends effort chasing records rather than reviewing them. Second, monitoring often happens in conversations and is not written down, which leaves no proof that a training session was delivered, that an audit covered a given processing activity or that advice on a DPIA was followed up. Ask the organization to decide where each type of record lives, who owns it and how often it is reviewed. Confirm with your supervisory authority or legal counsel how much detail it expects for monitoring records, because the GDPR does not prescribe a format.

Working Party 243 guidance notes that the DPO may also be assigned to maintain the records of processing activities, which is a practical way to keep the inventory that monitoring depends on. If the register is kept in a self-hosted tool, the DPO's monitoring log can reference the same processing entries, which avoids two sources that drift apart. Check the guidance itself in the Article 29 Working Party Guidelines on Data Protection Officers before setting the scope of the role, and keep the text of Article 39 in front of the team when defining each task.

Which processing, teams and third parties does the DPO's monitoring cover?

Article 39 monitoring only works if the DPO knows what it covers. The decisions below set the boundary of processing, business units and processors, and the order in which the DPO's limited time goes to the highest-risk work.

Processing operations in the record

Start from the record of processing operations, since the DPO's monitoring is only as complete as the inventory it draws from. WP243 rev.01 notes that the DPO may be assigned to maintain that record, and that assignment changes what the DPO must check. Confirm which processing activities are listed, who owns each entry, and whether systems that process personal data appear under a business purpose. Unlisted processing is the first gap an assessor will look for.

Systems that hold personal data

Decide whether monitoring reaches only the applications named in the record or also the databases, file shares, analytics platforms, backups and logs those applications feed. An illustrative case: a customer support tool may be in scope while its exported ticket archive on a shared drive is not. Ask IT for a system inventory tied to personal data categories, and confirm which environments, including test and staging copies, the DPO can review.

Business units and staff in scope

Decide which departments, subsidiaries and regional teams sit inside the monitoring programme, especially where a group-wide DPO covers several entities. Article 39(1) includes awareness-raising and training, so staff who handle personal data must be reachable by the DPO's audits and training records. Confirm who is accountable in each unit for the DPO's findings, and where local teams make their own processing decisions.

Processors and sub-processors

Decide how far monitoring extends to processors that act on the organization's instructions and to the sub-processors they engage. The controller remains responsible for compliance under WP243 rev.01, so the DPO needs a current list of processors, contract status and any audit rights in those contracts. Ask whether the DPO can review a processor's security evidence or only receive a summary, and who escalates when a processor changes its sub-processors.

Risk-based prioritization

Article 39(2) requires the DPO to give due regard to the risk of processing, taking into account its nature, scope, context and purposes. Use that test to rank the queue: sensitive data, large-scale profiling, vulnerable individuals and new technology usually go first. Document the ranking criteria, review them when processing changes, and be able to show why a low-risk activity was checked less often than a high-risk one.

Triggers that change the scope

Set explicit triggers that pull new work into monitoring: a new processing purpose, a new processor, a cross-border transfer, a DPIA that reaches the DPO, or a security incident involving personal data. Each trigger should have an owner who notifies the DPO in time. Without these triggers, the DPO learns of changes after launch, which weakens the advice the Article 39 tasks require.

How an assessor tests the DPO's minimum tasks

This table sets out how an assessor tests each of the five minimum DPO tasks in Article 39, the evidence usually requested and the findings that appear most often. Read it as a checklist of the organization's arrangements, since the assessment examines the controller or processor's system around the DPO rather than the DPO as an individual. Each row shows what to have ready before an assessment begins.

Task under Article 39	Test approach and evidence requested	Common findings
Inform and advise the organization and its staff	Assessor reviews the DPO's written advice log, the recipients, the dates and whether the controller acted on it. They ask for examples of advice given on new processing, vendor contracts and staff questions.	Advice given verbally with no record. Advice recorded but no evidence the business decided or acted on it.
Monitor compliance, including responsibilities, awareness and training	Assessor checks the allocation of data protection responsibilities across teams, the monitoring plan, training content, completion records and how gaps are escalated and closed.	Training delivered without attendance or completion records. Responsibilities named in policy but not assigned to any owner in practice.
Monitor and advise on DPIAs	Assessor samples DPIAs, checks that the DPO's advice was requested, recorded and either followed or justified in writing, and confirms reviews happen when processing changes.	DPO not consulted before processing started. DPIA signed off with no record of the DPO's view or reasons for departing from it.
Cooperate with the supervisory authority	Assessor asks for the procedure for cooperation, any past correspondence with the authority, and how requests are routed to and answered by the DPO.	No documented cooperation procedure. Contact route unclear, so requests from the authority sit with staff who lack authority to respond.
Act as contact point for the supervisory authority	Assessor checks that the DPO's contact details are published and communicated to the authority, and that a deputy or cover arrangement exists for absence.	Contact details missing from the privacy notice or the authority's records. No cover when the DPO is unavailable.
Risk-based prioritization of tasks (Article 39(2))	Assessor reviews how the DPO's work plan ranks processing operations by nature, scope, context and purposes, and whether high-risk areas receive more attention.	Work plan treats all processing equally. No record of why some high-risk activities were reviewed late or not at all.

How to set up the DPO's task cycle step by step

This sequence turns the DPO's Article 39 tasks into a repeatable cycle, so that advice, monitoring, DPIA oversight and supervisory authority contact each leave a record the organization can show. The controller or processor owns every step, and the DPO runs the cycle and records what it produces.

Confirm the mandate and reporting line
Start by writing down the DPO's tasks as the organization will carry them out, who appoints the DPO, and the line along which the DPO reports to management. Record which tasks the DPO performs personally and which belong to business owners, IT or security. The output is a short signed mandate that names the DPO's contact details and the tasks in Article 39(1). You know the step is done when each task has a named owner and the DPO confirms the list in writing.
Build the register of processing operations
Work with system owners to list every processing operation that handles personal data, including purposes, categories of data, recipients and where the data is stored. The DPO can maintain this record if the controller assigns it, but the controller remains responsible for its accuracy. The output is a register that the DPO uses to judge where risk sits and which systems need a DPIA. The step closes when each system owner has confirmed their entries and the register is version controlled.
Define the advice log and DPIA review calendar
Create a log where requests for advice are recorded with the question, the advice given, the person who decided and the outcome. In the same tool, set up a DPIA review calendar that lists each assessment, its owner and the trigger for review, such as a change in purpose, system or data category. The DPO applies a risk-based approach when deciding which items need review first, as Article 39(2) requires. The output is a log and calendar that show when the DPO advised and when each DPIA was last checked.
Schedule training and compliance audits
Plan awareness sessions and role-specific training for staff who handle personal data, and schedule internal audits that test whether policies match practice. Record attendance and the topics covered, and log each audit finding with an owner and a closure date agreed with management. The DPO monitors these activities and reports results, while the business remains responsible for fixing findings. The step is complete when the training plan and audit schedule are approved and the first findings are logged.
Set the supervisory authority contact procedure
Write a procedure that says who speaks to the supervisory authority, how inbound letters are received and logged, and how the DPO coordinates the organization's responses. Confirm the authority that applies in each Member State where the organization operates, and identify the people who can provide technical facts for a reply. The output is a contact procedure with named deputies and a log of every exchange. You know the step is done when a tabletop walkthrough shows that a letter from the authority can reach the DPO and be answered from the log.
Run the annual review of the cycle
At least once a year, review the register, advice log, DPIA calendar, training records, audit findings and authority contacts together. Compare what was planned with what happened, identify overdue items and decide what changes to the processes or resources are needed. Report the outcome to the highest management level in a written note from the DPO. The output is a dated review record and an updated plan for the next cycle, which shows the regulator and auditors how the DPO's tasks are kept current.

Why written records of advice and monitoring carry the weight

The GDPR requires no certificate for the DPO's tasks, so the evidence is the organization's own documents. No audit report or certificate proves that advice was given, that monitoring took place or that training reached staff. An assessor or supervisory authority will look for dated advice memos, the DPO's written opinions on DPIAs and the decisions the controller took in response, monitoring plans with their findings, training attendance records and the follow-up on each finding. Article 39 describes what the DPO must do, but it does not prescribe a format, so the organization should agree one with the DPO early and keep it consistent. Records should show who asked, what was advised, what the controller decided and why, so that the decision trail can be read without the people who made it.

Working Party 29's guidelines on DPOs, WP243 rev.01, describe the DPO as an advisor and monitor rather than the party responsible for compliance. The guidelines state that DPOs are not personally responsible for non-compliance, and that compliance remains the responsibility of the controller or processor. This matters for how the paper trail is written. Advice should be recorded as advice, with the controller's documented decision alongside it, so that an overruled recommendation is visible and the controller owns the outcome. Organizations should confirm that their internal records and job descriptions reflect this split and do not place accountability for outcomes on the DPO alone.

The same guidelines note that nothing prevents the controller or processor from assigning the DPO the task of maintaining the records of processing operations under its responsibility. If the controller makes that choice, the record of processing becomes one of the DPO's working documents, and the organization should decide who maintains each entry, who approves changes and how changes are dated and versioned. Systems teams should be asked to confirm that each processing activity they run is listed with its purposes, data categories and recipients, because an accurate record depends on operational input the DPO cannot collect alone. Whichever allocation is chosen, the controller remains responsible for the record's accuracy.

Which records prove that the DPO's tasks are performed?

Article 39 tasks leave a trail only if the DPO's work is written down as it happens. The records below show that advice was given, monitoring took place, and cooperation with the supervisory authority was handled. Keep each one current between audits, not only when an assessor asks for it.

Written DPO advice and outcomes

Keep a dated register of every piece of advice the DPO gives to management, system owners and staff, with the question asked, the advice, and what the organization decided. Where the organization did not follow the advice, record the reasons. Review the register at each monthly governance meeting and close any open item with a recorded outcome. Assessors look for this pattern: advice given, decision taken, follow-up checked.

Monitoring plan and audit reports

The DPO's monitoring plan should set out which processing activities, controls and suppliers are checked, how often, and by whom. Each completed check produces a short report with findings, owners and due dates. Update the plan when new systems or processors are added, not only at the annual review. Confirm that the plan covers the controller's own records and the processor contracts the organization relies on.

Training attendance and content

Article 39 includes awareness-raising and training for staff involved in processing. Keep attendance records, the version of each course, and quiz or completion results where used. Update course content when laws, guidance or internal policies change, and log the version date. For learning platforms such as Moodle, activity completion settings decide whether a course is marked complete on viewing, on grading or by manual tick, so confirm the configured condition matches what you claim in the record.

DPIA advice records

Where the DPO is asked to advise on a data protection impact assessment, keep the request, the advice given, the controller's response and the final decision. The DPO's advice should show the risk considered and the reasoning behind any mitigation accepted or rejected. Store these records with the DPIA itself so an assessor can trace the advice from request to decision. Check that each DPIA shows when the DPO was consulted and that the advice is not only attached after sign-off.

Supervisory authority correspondence log

Article 39 makes the DPO the contact point for the supervisory authority. Maintain a log of every letter, email, call and information request, with the date received, the deadline, the responder and the response sent. Keep copies of the submitted material and note any extension granted. The log should be reviewed for overdue items at each governance meeting, so gaps are found before a regulator finds them.

Annual DPO review

Record an annual review of the DPO's performance against the Article 39 tasks, covering the advice log, monitoring results, training coverage, DPIA involvement and authority contacts. Note the resources the DPO used and any gaps raised. Present the review to the highest management level and record the decisions taken on it. Between audits, the review is the anchor that shows the other records are maintained and acted on.

What performing the DPO's tasks costs in time and money

This table itemizes the cost components of the Article 39 tasks, who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No figures are supplied for these components, so use the right-hand column to build questions for internal budgets and external quotes.

Cost component	Who is paid or who carries it	One-time or recurring	What drives it and what to ask for in a quote
DPO time for advice and inform duties	Internal staff time or an external DPO provider	Recurring	Volume of questions from product and staff. Ask the provider how advice is logged, response expectations and how many hours are included.
Monitoring and audit effort	Internal audit, DPO office or an external reviewer	Recurring, with a heavier first cycle	Number of processing operations to sample and systems in scope. Ask what sampling method is used and what evidence is returned.
Staff training delivery	Internal trainers, learning platform or external trainer	One-time build, recurring refresh	Number of staff roles, turnover and content updates. Ask who owns the course material and how completion is recorded.
DPIA advice and monitoring	DPO time, with business and engineering teams doing the assessment	Recurring, varies with project pipeline	Number of new high-risk processing projects and review cycles after changes. Ask how DPIA reviews are scheduled and billed.
Processing register and advice log tooling	Software licence or self-hosted platform, plus setup services	Setup one-time, licences and hosting recurring	Number of processing activities and the need for audit trails. Ask whether the tool exports records in a form a supervisory authority would accept.
Supervisory authority contact handling	DPO time, sometimes legal counsel	Recurring, event-driven	Complaint and inquiry volume and cross-border cases. Ask how urgent requests are routed and who covers absence.
External review of the DPO function	Independent reviewer or consultant	Periodic	Scope of the review and the depth of testing. Ask for the written scope, deliverables and whether the reviewer issues findings only, without certifying compliance.

Who performs each DPO task, and what is worth outsourcing

The organization keeps every decision that carries legal responsibility. Under the GDPR, compliance stays with the controller or processor, and the Article 29 Working Party guidance on DPOs (WP243 rev.01) is explicit that a DPO is not personally responsible for non-compliance. That means the organization decides which risks are acceptable, which processing is lawful, who owns each control, and what the DPO is told and when. Staff time is also internal: business owners must attend training, answer questions about their processing, and act on DPO advice.

Decisions: accepting residual risk, approving DPIA outcomes, and choosing whether to follow DPO advice, with reasons recorded if it does not.
Staff time: system owners and engineers who describe processing and implement fixes cannot be outsourced away.
Assignment of responsibilities: naming control owners for each processing activity is an internal act.
Resources: budget, access and reporting lines for the DPO sit with senior management.

Before signing any contract, confirm in writing which decisions stay with your executives and which tasks the external party will perform.

Where DPO task arrangements usually fall short

Most gaps under Article 39 are not missing duties but missing records. Advice that is given but not written down, or monitoring that stops at the controller's own walls, leaves the organization unable to show what its DPO actually did. Each card below pairs a common gap with a practical fix.

Advice given verbally

The DPO informs and advises the organization and its staff, but when that advice lives only in hallway conversations or meeting chatter, nobody can later show what was recommended or whether the business followed it. Keep a simple advice log with the date, the requester, the question, the advice given and the decision taken. Check that a sample of recent decisions can be traced back to a written opinion.

DPIA advice disconnected from release

The DPO must advise on and monitor DPIAs, yet many teams only involve the DPO after a feature is built. The advice then arrives too late to change the design. Add a DPIA checkpoint to the product release workflow so that a release cannot pass the gate without a recorded DPO opinion or a documented reason for proceeding against it. Ask engineering to show the gate in the pipeline or ticket template.

Training that is not tracked

Monitoring compliance includes awareness-raising and training, but many organizations run sessions without recording who attended, who completed required modules or who is overdue. Without that record, the DPO cannot show an assessor that staff who handle personal data were reached. Use a learning platform with completion tracking, and set completion as a condition for access to systems that process personal data. Review overdue records each quarter.

No supervisory authority contact procedure

The DPO acts as the contact point for the supervisory authority, but many organizations have no written procedure for who receives an inquiry, who answers it within the deadline in the letter and who approves the response. A missing procedure means a regulator's letter can sit in a general mailbox. Write a short runbook covering intake, routing, legal review, sign-off and the record kept of each exchange, and test it with a tabletop exercise.

Monitoring that stops at the boundary

Compliance monitoring usually covers internal systems and misses processors and sub-processors that handle the same data. The organization remains responsible for their handling of personal data, yet nobody reviews their contracts, security evidence or incident notices against the controller's requirements. Build a processor review schedule that asks each supplier for current evidence, tracks instructions issued and records any findings in the same register used for internal audits.

Risk-based priorities not written down

Article 39(2) asks the DPO to give due regard to the risk of processing, considering its nature, scope, context and purposes. When monitoring effort is spread evenly across every activity, high-risk processing gets the same attention as routine administration. Keep a ranked list of processing activities with a stated reason for each rank, and let it set the audit and training plan for the year. Confirm that the ranking is reviewed when processing changes.

How much effort does Article 39 take, and can we do it ourselves?

Can a small team perform the Article 39 DPO tasks in-house?

Yes, a small team can perform the Article 39 tasks in-house if one person has the time, authority and knowledge to do them. Article 39 does not set a headcount or a qualification route for the role, so the question is capacity and independence rather than size. The tasks cover advising the organization and its staff, monitoring compliance including training and audits, advising on DPIAs, and acting as the contact point for the supervisory authority. Before deciding, check whether the person can give advice without being told what conclusion to reach, and whether their other duties would create a conflict of interest under Article 38. Where the same person runs IT, marketing or HR processing, the conflict question usually decides the matter before workload does.

What does the Article 39 work need from staff across the organization?

The tasks depend on other teams supplying information on time, so the workload falls on engineering, product, procurement, HR and security as much as on the DPO. The DPO needs access to records of processing, system inventories, vendor contracts, DPIA files, training records and audit findings. Business owners must consult the DPO before launching processing that may carry high risk, and engineers must share architecture details that a DPIA requires. Ask each department to name a contact who answers DPO requests. Without that routing, the DPO spends most of the effort chasing documents rather than advising.

How long does it take to set up the DPO function?

Setup time depends on the size of the processing estate, how much documentation already exists, and how many teams must be trained. The main drivers are the number of processing activities to review, the state of the record of processing, the number of systems that hold personal data, and whether existing DPIAs need rework. Article 39(2) asks the DPO to give due regard to risk, so a small organization with simple, low-risk processing needs less early effort than one running profiling or large-scale monitoring. No duration is given here because the Article itself sets none. Ask the provider or internal lead to build the estimate from a written inventory of processing and systems.

What should we ask an outsourced DPO provider for in a quote?

Ask for a written scope that lists each Article 39 task and states what the provider will do, what the organization must supply, and what is excluded. Request the expected number of hours or days per month, the named individual who will act as DPO, and how they will cover absence. Ask how they handle the supervisory authority contact role, how they document advice given, and how they escalate a personal data breach or a DPIA that cannot be mitigated. Also ask whether records of processing maintenance is included, since WP243 rev.01 notes that the DPO may be assigned that task. Confirm recurring fees, one-time onboarding work, and the notice period for ending the arrangement. DeployOpen does not publish prices; a quote follows from a written scope.

Does an outsourced DPO remove the controller's responsibility for compliance?

No. An outsourced DPO does not remove the controller's or processor's responsibility for compliance. WP243 rev.01 states that DPOs are not personally responsible for non-compliance, and that compliance remains the responsibility of the controller or processor. The organization must still decide on processing, approve DPIAs, fund the work, and act on the DPO's advice or record why it did not. A provider can prepare evidence and advise, but it does not issue an attestation of compliance, and no GDPR audit or certificate is required. If you engage an outside party, keep the decision authority and accountability inside your own management.

What recurring work continues after the initial DPO setup?

Most of the Article 39 effort recurs. Monitoring compliance, delivering awareness and training, reviewing DPIAs when processing changes, and answering questions from staff continue for as long as the organization processes personal data. Audits repeat on a schedule the organization sets. Regulation (EU) 2025/2518 applies from 2 April 2027 and adds procedural rules for cross-border enforcement, so cooperation with authorities may need updated procedures by then. Budget for the ongoing role as an operating cost, not a one-time project. Ask any provider which parts of this work are in a retainer and which are billed per request.

Which parts of the DPO role does DeployOpen help with?

DeployOpen plans, implements, documents and supports self-hosted open-source platforms in the client's own infrastructure. For the Article 39 role, that means preparing systems, inventories and evidence that the DPO and the organization can use, such as configuring a compliance platform for assessments. DeployOpen does not act as a DPO, issue audit reports or certify compliance. The organization keeps its controls and decisions. Any DPO appointment, advice and external contact with the supervisory authority should come from a person or firm that the organization engages in its own name. Confirm the exact scope in writing before work starts.

How DeployOpen prepares systems and evidence for Article 39

DeployOpen works on Article 39 by preparing the systems, records and evidence a data protection officer uses to inform, advise and monitor compliance. The controller keeps ownership of its decisions, and an independent auditor or supervisory process judges the result.

How we scope

Agree in writing which Article 39 tasks the platforms and workflows must support, such as advice logs, DPIA review queues and training records.
Confirm which self-hosted systems hold personal data and which teams the DPO advises, so monitoring covers the right processing operations.
Define who owns each task, including whether the controller assigns record-keeping to the DPO, and document that split before work begins.

How we build

Configure open-source platforms inside your own infrastructure to hold DPIA registers, risk-based review schedules and assignment of responsibilities.
Set up training completion tracking and awareness records so the DPO can show who was trained, when and on which topics.
Connect DPIA workflows to the DPO's advice record so each consultation, recommendation and follow-up is traceable.

How we hand over

Deliver runbooks describing how the DPO monitors compliance, requests audit evidence and logs contact with the supervisory authority.
Provide evidence packs that show configuration, access rights and audit trails for each in-scope platform, mapped to the agreed tasks.
Walk through the handover with the DPO and staff so ownership, review cadence and open actions are clear before engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope engagement ends.
Retainers can cover periodic review of DPIA registers, training records and platform changes that affect processing operations.
Confirm with your auditor or legal advisers which evidence they expect, since DeployOpen prepares evidence but does not issue reports or certificates.