Under GDPR Art. 37, when must an organisation designate a Data Protection Officer, and could its CTO hold that role?

## When a DPO is mandatory **Art. 37(1)** of the GDPR says *"the controller and the processor shall designate a data protection officer in any case where"*: | Point | Trigger | Typical reading | |---|---|---| | **(a)** | processing by a **public authority or body**, except courts acting in their judicial capacity | ministries, municipalities, public hospitals | | **(b)** | **core activities** consist of processing that, by nature, scope or purposes, requires **regular and systematic monitoring** of data subjects **on a large scale** | behavioural advertising built on tracking, location tracking as the product | | **(c)** | **core activities** consist of **large-scale** processing of **special categories** of data (Art. 9) or data on **criminal convictions and offences** (Art. 10) | a hospital's patient records, a background-check business | Three details decide most cases: - **Core activities.** Recital 97 says core activities *"relate to its primary activities and do not relate to the processing of personal data as ancillary activities."* Every company runs payroll and HR. That is ancillary and does not by itself trigger a DPO. - **Both conditions in (b) and (c).** Point (b) needs monitoring that is regular and systematic *and* on a large scale. Point (c) needs special-category or criminal data *and* large scale. The Regulation does not define "large scale" by a number. - **Processors too.** A processor whose core business is large-scale monitoring must designate its own DPO. Outside these cases, **Art. 37(4)** lets any controller or processor appoint a DPO voluntarily, and Member State law can make it mandatory more widely. Art. 37(1) has no headcount trigger. The 250-person figure some candidates cite belongs to the Art. 30(5) record-keeping exemption, not to Art. 37. ## Who can be the DPO - **Art. 37(5)**: designated on professional qualities, *in particular expert knowledge of data protection law and practices*, and the ability to do the Art. 39 tasks. The Regulation names no specific diploma. - **Art. 37(6)**: a staff member *or* someone working under a **service contract**, so an external DPO is allowed. - **Art. 37(2)**: a group of undertakings may share one DPO if the DPO is easily accessible from each establishment. - **Art. 37(7)**: the DPO's contact details are **published** and **communicated to the supervisory authority**. ## The position the Regulation protects **Art. 38** is what makes the role more than a title: 1. **Involved properly and in a timely manner** in all issues relating to personal data protection (38(1)). In a breach, that includes being brought in early. 2. **Resourced**, with access to personal data and processing operations (38(2)). 3. **No instructions** on how to exercise the tasks, **no dismissal or penalty** for performing them, and **direct reporting to the highest management level** (38(3)). 4. **Contactable by data subjects** on all issues about their data and rights (38(4)). 5. **Bound by secrecy or confidentiality** (38(5)). 6. **May hold other tasks**, but the controller must ensure *"any such tasks and duties do not result in a conflict of interests"* (38(6)). **Art. 39** sets the minimum tasks: inform and advise; **monitor compliance**, including staff training and related audits; advise on **DPIAs**; **cooperate** with the supervisory authority; and act as its **contact point**. Note the verbs: advise and monitor. The Regulation puts the compliance obligations on the controller and processor, not on the DPO personally. ## The CTO, or the head of marketing, as DPO Art. 38(6) allows a DPO to have other duties, so the question is whether *this* combination conflicts. The reasoning comes straight from the Articles: - The CTO or head of marketing **decides** how personal data is processed: which systems collect what, which campaigns target whom. - Art. 39 makes the DPO the person who **monitors** whether that processing complies and **advises** on it. - One person in both roles audits their own decisions. They also sit in the management line the DPO is meant to report to without instructions under Art. 38(3). That is the conflict Art. 38(6) forbids. A common answer is to place the DPO where they advise decision-makers without being one: in a legal, risk or compliance function, or with an external DPO under Art. 37(6). ## Where the DPO meets breach handling Under **Art. 33(3)(b)**, every breach notification gives the DPO's name and contact details (or another contact point), and Art. 34(2) carries the same item into the communication to individuals. EDPB Guidelines 9/2022 recommend informing the DPO promptly of a breach and involving them throughout the breach management and notification process.