EU compliance software for the DPO mandate

GDPR Article 39 assigns DPOs five mandatory tasks: (a) informing and advising the controller, processors, and employees about their GDPR obligations; (b) monitoring compliance with GDPR and internal data protection policies; (c) advising on and monitoring Data Protection Impact Assessments under Article 35; (d) cooperating with the supervisory authority; and (e) acting as the supervisory authority's contact point. These tasks cannot be delegated away from the DPO.

GDPR Article 37 requires DPO appointment in three cases: (1) the controller or processor is a public authority or body; (2) the core activities require large-scale regular and systematic monitoring of data subjects (e.g. behavioural advertising, HR monitoring); or (3) the core activities involve large-scale processing of Article 9 special-category data or Article 10 criminal conviction data. Organisations outside these cases may voluntarily appoint a DPO, but Article 38 and 39 obligations then fully apply.

Article 30 GDPR requires the controller's ROPA to include: name and contact details of the controller and DPO; purposes of the processing; categories of data subjects and personal data; categories of recipients; third-country transfers and applicable safeguards; data retention periods where possible; and a general description of technical and organisational security measures. Organisations under 250 employees have a partial exemption unless their processing is likely to result in risk, is not occasional, or involves special-category data.

Article 35(7) GDPR requires a DPIA to contain: a systematic description of the envisaged processing and its purposes; an assessment of the necessity and proportionality of the processing; an assessment of risks to data subjects; and measures to address those risks including safeguards and security measures. The DPO advises and monitors the process — the controller carries it out. If a high residual risk cannot be mitigated, the supervisory authority must be consulted before processing begins (Article 36).

Under GDPR Article 33, a personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in risk to individuals. Notification must include: the nature of the breach; categories and approximate number of data subjects and records; contact details of the DPO; likely consequences; and measures taken or proposed. Article 34 requires direct notification to affected individuals when the breach is likely to result in high risk.

The EU AI Act creates several obligations that overlap with the DPO's mandate: the fundamental rights impact assessment for high-risk AI systems in public authority contexts (Article 27) maps closely to a DPIA and the DPO is a natural contributor; biometric-categorisation AI systems have restrictions that intersect with GDPR Article 9 special-category prohibitions; and AI Act transparency obligations for AI systems interacting with individuals parallel GDPR information obligations under Articles 13 and 14.

A DPO cannot be personally fined for GDPR breaches committed by the controller or processor — the controller and processor are responsible parties under Article 83. However, a DPO can be removed for failing to perform Article 39 tasks adequately. GDPR Article 38(3) protects DPOs from being penalised for performing their tasks — but this protection does not extend to actions outside the DPO's mandate or to personal misconduct.

For controllers with EU establishments in multiple Member States, the lead supervisory authority (LSA) is the authority in the Member State of the controller's main establishment. The DPO serves as the contact point for the LSA under Article 39(1)(e). Article 60 establishes cooperation obligations between the LSA and all concerned supervisory authorities for cross-border cases. DPOs should be able to communicate effectively with the LSA, which may require language capabilities or local presence for complex cross-border operations.