Data protection officer

A data protection officer is a qualified contact person for an organisation’s data protection arrangements. Article 37 GDPR requires an appointment in particular where processing is carried out by a public authority or body, where the controller’s or processor’s core activities require regular and systematic monitoring of people on a large scale, or where the core activities involve large-scale processing of special categories of personal data or data relating to criminal convictions and offences. The actual core activities matter, not the organisation’s label.

The data protection officer may be an employee or an external service provider. The officer advises the controller and staff, monitors compliance, supports training, contributes to data protection impact assessments and cooperates with the supervisory authority. When carrying out these tasks, the officer must not receive instructions on the professional assessment and must not face a conflict of interest. The organisation must provide appropriate resources and give the officer direct access to the highest management level.

Businesses should document the appointment, contact details, responsibilities and involvement in relevant decisions. The officer’s contact details must be made public and communicated to the Austrian Data Protection Authority. The privacy compliance and governance topic helps organise responsibilities and evidence. The role check supports an initial distinction between controller and processor. For service providers, see processors and service providers and the processor checklist. The topic on data subject rights and access covers requests from individuals.