Data Protection Officer (DPO)

What we do

Within an organization, a person must oversee the handling of personal data. This person is referred to as the Data Protection Officer (DPO). One of our privacy specialists from the Privacy and Data Protection practice group can fill the position of DPO within an organization. Additionally, legal advice can be provided so that the DPO within an organization knows what is expected of him or her.

Questions regarding the position of Data Protection Officer? Please contact us.

When is a Data Protection Officer mandatory?

Whether your organization must appoint a DPO follows from Article 37 of the General Data Protection Regulation (GDPR). A DPO is mandatory in three situations: (1) you are a public authority or public body; (2) your core activities consist of large-scale, regular and systematic observation of individuals; or (3) your core activities consist of large-scale processing of special categories of personal data (such as health, biometric or criminal data). Whether there is a case of “large-scale” and “core activity” is often a case-by-case legal assessment. Our lawyers and in-house counsel assess this for each organization individually – from an international group to a healthcare practice or the webshop around the corner. Even if appointment is not mandatory, a voluntary DPO can be sensible; ensure that a voluntarily appointed DPO meets the same GDPR requirements.

Tasks of the DPO (Article 39 GDPR)

The minimum duties of a Data Protection Officer are set out in Article 39 of the GDPR. The DPO:

• informs and advises the organization and its employees about their obligations under the GDPR and other privacy regulations;
• oversees compliance with the GDPR, including the allocation of responsibilities, staff awareness and training, and the conduct of audits;
• advises, upon request, on a Data Protection Impact Assessment (DPIA) and supervises its implementation;
• collaborates with the Dutch Data Protection Authority (AP) and acts as a point of contact, including in the event of data breaches.

The DPO is a supervisor and advisor, not an implementer: he or she is not personally responsible for compliance – that responsibility remains with the controller.

Position, facilities and independence (Article 38 GDPR)

Article 38 of the GDPR safeguards the position of the DPO. The organization must involve the DPO in a timely and proper manner in all matters concerning the protection of personal data, provide him or her with sufficient resources and access to data, and not dismiss or punish the DPO for performing his or her duties. The DPO reports directly to senior management. An important feature is legally enshrined independence: the DPO receives no instructions regarding the manner in which he or she performs the duties. The DPO may perform other duties, provided this does not lead to a conflict of interest – for instance, someone who decides on processing purposes themselves cannot simultaneously be an independent DPO. Finally, the DPO is bound by confidentiality regarding the performance of his or her duties.

Internal DPO, external DPO or Privacy Officer?

A DPO can be an in-house employee or hired externally; the GDPR permits both, and organizations may also share a joint DPO. For many SMEs, healthcare institutions, and educational organizations, an external DPO is attractive: you gain independent expertise without having to set up a permanent position. Our (corporate) legal counsel and lawyers from the Privacy and Data Protection practice group can act as an external DPO or provide legal support to an internal DPO. Note the distinction with a Privacy Officer: the latter implements the privacy policy in practice (maintaining registers, handling requests), whereas the DPO exercises independent oversight. Combining both roles in one person can quickly lead to a conflict of interest.

Reporting to the AP and risks of non-compliance

If your organization has appointed a DPO, you must register them with the Dutch Data Protection Authority and make their contact details public (Article 37, paragraph 7 GDPR). The DPO actively checks whether mandatory organizations have a DPO. Failing to appoint or register a DPO incorrectly is a violation of the GDPR for which the DPO may impose a fine. A well-positioned, independent DPO is therefore not only a legal obligation but also limits your liability risk. We are happy to combine this assessment with a privacy audit to bring your entire privacy management into order.

Our approach: from corporations to the baker on the corner

MKB Juristen works with mixed teams of lawyers and in-house counsel. This allows us to switch seamlessly between strategic privacy advice for an international group and practical, affordable support for the small business owner. We assess whether you require a DPO, fulfill that role as an external DPO if desired, support your internal DPO, and assist with the setup of your broader privacy compliance. This page is part of our Privacy and Data Protection, where you can also turn to us for related topics such as data breaches, DPIAs, and privacy audits.