When a DPO must be appointed, what the board should expect from that role and how to document accountability under the GDPR.
Legal status: August 2026
See also: NIS2 and KSC Incidents and Breaches Training and workshops AI Act
An external DPO for your organisationWhether the role is required, how it should be set up and what evidence it has to produce depend on how your processes actually run. Let us start with a conversation about yours — no obligation and no sales preamble. Explore the service
Article 38(2) GDPR requires the DPO to be given resources for the tasks, access to personal data and processing operations and resources to maintain expert knowledge. The provision sets no hours or amounts, so the organisation assesses the scale for its own case and should be able to show that assessment.
According to UODO, a contract with an external DPO is a service contract and not a data processing agreement. Its subject matter is the tasks under Article 39(1) GDPR. The contract may set the framework of cooperation, but it may not contain instructions regarding the exercise of the officer’s tasks.
The GDPR contains no list of positions excluded from the role of data protection officer. The exclusion is decided by three separate provisions, and what settles a conflict of interests is the scope of decisions about purposes and means of processing, not the job title.
The regulation allows both models and holds them to the same requirements. The choice is not about compliance but about conditions. These are the workload of the role, conflict of interests, and availability and knowledge of the organisation.
The board should expect from the data protection officer a picture of the state of data protection, not a report of activities. Six areas make up that picture. The GDPR does not set the format of the report, but it does settle that the flow of information has to exist.
The GDPR does not specify training frequency. The rhythm is set by changes in processes, staff turnover, conclusions from incidents, and test results — and for entities covered by the KSC Act, there is a strict deadline for management.
The obligation to appoint a Data Protection Officer arises in three cases under Article 37(1) of the GDPR. None of the conditions refer to the size of the organization — the nature of the activity and the scale of processing are decisive.
