How does a change of data protection officer work and what should the new DPO take over?

Why this question arises at all

The GDPR sets out the designation of the data protection officer, his or her position and tasks (Articles 37 to 39). On dismissal it says only that it may not take place for performing the tasks (Article 38(3)). The Article 29 Working Party Guidelines on Data Protection Officers (WP 243) point to this gap expressly. According to them the GDPR does not specify how and when a DPO can be dismissed or replaced by another person. Articles 10 and 11 of the Polish Personal Data Protection Act specify the notification to the President of the UODO and the publication of the details under Article 37(7) GDPR. The Act also allows a deputy DPO to be designated (Article 11a). None of these provisions governs the handover of the function to a successor.

The board wants to end the cooperation without breaching the guarantees of the DPO’s independence and without a gap in obligations. The new DPO wants to know what he or she inherits and where to start. Up to 30 March 2022 the UODO had received few reports from DPOs. They concerned, among other things, outdated DPO details on controllers’ websites and the reasons for dismissals. They also concerned a provision in internal organisational rules stating that the DPO may be dismissed at any time.

What has to be established before changing the DPO

Why the predecessor’s function ends

The data protection officer shall not be dismissed or penalised by the controller or the processor for performing his or her tasks (Article 38(3) GDPR). The WP 243 guidelines give an example. A DPO may consider a processing operation to be likely to result in a high risk and advise the controller to carry out a data protection impact assessment, while the controller disagrees with that assessment. The DPO cannot be dismissed for providing this advice. According to the UODO the provision should be read as referring to the objectively proper performance of the tasks. It is not meant to protect a DPO who does not perform his or her tasks properly.

The guidelines allow dismissal in legitimate cases for reasons other than performing the DPO’s tasks. According to the guidelines, national contract or labour and criminal law then applies as it would to any other employee or contractor. As examples the guidelines give theft, harassment and other similar gross misconduct. It is worth recording the reason for the change in the organisation’s documents. In practice an allegation that the change is connected with performing the tasks is easier to make when the decision follows soon after a dispute over the DPO’s advice.

For a DPO employed under a contract of employment, dismissal from the function and the amendment or termination of the contract are usually two separate acts. Where the function is a position named in the contract, the dismissal is best agreed with HR together with the amendment of the contract. Even when the DPO has handed in his or her notice, it is advisable for the board to dismiss him or her from the function in writing with a date. Until the board does so, a DPO released from the duty to work during the notice period formally holds the function without performing it. The release from the duty to work is best granted only after the matters have been handed over to the successor. The dismissal is best set to take effect at the end of the day before the successor’s designation. The day of the successor’s designation is best set a few days before the end of the notice period so that the predecessor has time to hand over the matters and sign the handover record.

An external DPO usually ends the function when the service contract ends. According to the Court of Justice of the EU the second sentence of Article 38(3) GDPR applies without distinction to a DPO who is a member of staff and to a DPO who fulfils the tasks on the basis of a service contract (judgment C-534/20, paragraph 23). The provision also protects an external DPO against any decision terminating his or her duties where that decision relates to the performance of his or her tasks (paragraph 28). A change also occurs when the DPO resigns or when the service provider proposes another person in his or her place. However, the organisation designates the DPO (Article 37 GDPR), so the new person becomes the DPO only after the organisation’s decision. It is advisable for the contract with the provider to require the organisation’s consent to such a replacement. In my assessment the organisation notifies the President of the UODO under Article 10(4) of the Act in all these cases because the person notified as DPO ceases to be one. Of the ways in which the function ends the provision expressly mentions only dismissal. Covering these cases by Article 10(4) is supported by the UODO Bulletin listing forms only for designation, dismissal and a change of details and for dismissal combined with the designation of a successor. The notice period and cooperation in handing over the matters are best written into the contract from the outset, as the text What should a contract with an external data protection officer contain? shows.

Can the organisation be left without a DPO

An organisation obliged to designate a DPO (Article 37(1) GDPR, Article 8 of the Act) designates one in any case where one of the conditions is met. The law provides for no break to look for a successor. The 14-day period in Article 10 of the Act concerns the notification to the President of the UODO and not the designation itself. The successor’s designation is best set for the day following the end of the predecessor’s function (the day of the change). According to the UODO the internal act or contract should clearly identify a specific person and the written form matters as evidence. An oral instruction from the controller does not determine whether the designation is effective.

The Act allows a person to be designated to stand in for the DPO during his or her absence (Article 11a(1)). In my assessment the deputy arrangement does not cover the period after the DPO’s dismissal because the provision links it to the DPO’s absence and after dismissal there is no one left to stand in for. Extending the deputy arrangement to that period is supported by the purpose that the UODO links to a permanent deputy, namely the continuity of the DPO’s work. As examples of absence the Office gives illness and leave, however. If the DPO leaves suddenly it is safer to designate the existing deputy as DPO straight away after checking for a conflict of interests. The organisation then dismisses that person from the function of deputy. According to the UODO a dismissal of the deputy is notified in the same procedure as a dismissal of the DPO but on a separate form for the deputy.

An organisation that designated a DPO voluntarily (Article 37(4) GDPR) may decide not to designate a successor. The condition is that the criteria in Article 37(1) are still not met and no other provision requires it. The decision is best based on a documented reassessment of the criteria, and the DPO’s details are best removed from the website, privacy notices and the record. According to the guidelines the requirements of Articles 37 to 39 apply to a voluntarily designated DPO as if the designation had been mandatory. The organisation notifies the President of the UODO of the dismissal in any event (Article 10(4) of the Act).

Who can become the new DPO

The successor is designated on the basis of professional qualities and in particular expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39 (Article 37(5) GDPR). He or she may be a staff member or fulfil the tasks on the basis of a service contract (Article 37(6)). His or her other tasks must not result in a conflict of interests (Article 38(6)). The limits of this requirement are shown in the text Who cannot act as a data protection officer?.

The WP 243 guidelines consider knowledge of the business sector and of the organisation of the controller useful. The DPO should also have a good understanding of the processing operations carried out and the controller’s information systems. The same applies to the data security and data protection needs of the controller.

Change of DPO in the notification to the President of the UODO

The entity that designated the DPO notifies the President of the UODO of the designation within 14 days of the date of designation (Article 10(1) of the Act). It gives the DPO’s first name and surname and e-mail address or telephone number. It also gives its own details under Article 10(3), including its REGON statistical number if one has been assigned. It notifies the dismissal of the DPO and any change in these details within 14 days of the date on which the change in details or the dismissal occurred (Article 10(4)). The notification is made in electronic form and bears a qualified electronic signature or a signature confirmed with the ePUAP trusted profile (Article 10(6)).

A change of DPO has its own form. On the biznes.gov.pl portal there is a service “Notify the dismissal of the previous and the designation of a new data protection officer” for which the UODO is responsible. According to the UODO Bulletin (archive materials from 2018 to 2022) this form is used when one person has been dismissed from the function and another person has been appointed in his or her place. According to the Office a notification sent on the wrong form must be sent again.

The 14-day period runs from the day of the predecessor’s dismissal and from the day of the successor’s designation. Where both acts have already taken place the joint notification must be filed within 14 days of the earlier of them. If no successor has been designated within that period, the dismissal is notified separately on the form for dismissal alone. The date on which the dismissal takes effect is best stated in the letter of dismissal and for an external DPO also in the notice of termination or the agreement ending the contract. The letter of dismissal is best signed and delivered on the last day of the function. The act designating the successor with effect from the day of the change is best signed on the same day as the letter of dismissal or on the day of the change. The period for the combined form then runs from the last day of the predecessor’s function.

The notification is signed by the persons authorised to represent the organisation and in the case of joint representation by each of the required persons. It may also be filed by a proxy who attaches a power of attorney granted in electronic form (Article 10(2)). The service description on biznes.gov.pl also lists confirmation of payment of the stamp duty on the power of attorney. Receipt of the notification is confirmed by an official acknowledgement of submission (UPP). According to the UODO Bulletin the filer assesses whether the notification is correct and a defective notification must be repeated. Where one DPO has been designated by a group of undertakings or by several public authorities or bodies, each of them files the notification (Article 10(5)). Each of them also updates the details on its own website (Article 11). According to the UODO Bulletin a notification of dismissal may be filed by the legal successor of the entity that designated the DPO where that entity was liquidated or taken over without such a notification.

If the organisation has a deputy DPO, it checks whether the change also concerns that person. The designation of a deputy is notified in the procedure under Article 10 and the deputy’s details are made available in accordance with Article 11 (Article 11a(3)). According to the UODO the same procedure covers the dismissal of the deputy and a change in the deputy’s details, and separate forms are provided for the deputy.

Change of DPO on the website, in the record and in privacy notices

The organisation makes the new DPO’s first name and surname and e-mail address or telephone number available on its website without delay after the designation (Article 37(7) GDPR, Article 11 of the Act). An organisation without a website makes them generally available at its place of business. According to the UODO the details should be placed somewhere easy to find, for example in a “Contact” or “Data protection officer” tab. The Office considers places that require lengthy searching to be inappropriate, such as “News” or “Privacy policy”.

The DPO’s contact details also appear in other documents. They are included in the controller’s record of processing activities (Article 30(1)(a) GDPR) and in the record of categories of processing activities kept by the processor (Article 30(2)(a)). Privacy notices also give them (Article 13(1)(b) and Article 14(1)(b)). In privacy notices the GDPR requires the contact details of the DPO and not his or her name. A breach notification (Article 33(3)(b)) and a communication to data subjects (Article 34(2)) on the other hand give the name and contact details of the DPO or other contact point. Where a notification is supplemented in phases (Article 33(4)) it is worth giving the new DPO’s details.

The WP 243 guidelines list a dedicated e-mail address among the contact details. A functional address in the organisation’s domain allows a change of DPO to be made without correcting privacy notices. It should belong to a separate shared mailbox and not be an alias on the predecessor’s account. An address in the former service provider’s domain has to be changed. Until then it is safer to agree with the provider on an automatic reply giving the new address than to forward mail. The new DPO collects from the provider on an ongoing basis any messages that nevertheless reach the old address. Where privacy notices give the predecessor’s personal address, the organisation corrects them in all data collection channels. The predecessor’s address is also sometimes written into data processing agreements as the contact for breach notifications. The new contact is worth giving to processors and to the controllers for which the organisation processes data. As good practice the guidelines recommend informing employees of the name and contact details of the DPO, for example on the intranet.

What the new DPO should take over

Most of the documents that the successor takes over do not belong to the DPO. The record of processing activities is kept by the controller or the processor (Article 30(1) and (2) GDPR). According to the WP 243 guidelines the obligation remains with them even where the DPO keeps the record in practice. Data protection policies are among the measures that the controller implements where proportionate in relation to processing activities (Article 24(2)). The organisation therefore organises the handover. The basis is its obligation to provide the DPO with access to personal data and processing operations and with the resources necessary to carry out the tasks (Article 38(2)). The outgoing DPO’s participation is best written into his or her contract.

The new DPO should receive materials and access from four groups. He or she needs the first two from the day of designation.

• Pending matters with a running deadline. Data subject requests to which the controller responds without undue delay and in any event within one month of receipt (Article 12(3)). Breaches under assessment as well as ongoing impact assessments and projects awaiting an opinion. Matters before the President of the UODO in which the DPO is the contact point (Article 39(1)(e)).
• Access. The contact channel for data subjects (Article 38(4)) and the systems needed to monitor compliance. Participation in management meetings as part of involving the DPO in all issues which relate to the protection of personal data (Article 38(1)).
• The controller’s documentation. The record of processing activities and the documentation of breaches under Article 33(5). Data protection impact assessments for which the controller seeks the DPO’s advice (Article 35(2)). Policies and procedures as well as data processing agreements. The predecessor’s act of designation and confirmations of the notifications filed.
• The predecessor’s work plan and recommendations. Audit results and the work plan including training. The list of recommendations that the organisation has not implemented together with the reasons.

The deadlines under Article 12(3) run from the controller’s receipt of the request. The provision does not suspend them during a change of DPO and allows an extension by two further months only taking into account the complexity and number of the requests. The change does not stop the 72-hour period for notifying a breach either, which runs from becoming aware of it (Article 33(1)). For the day of the change it is worth specifying who receives breach reports and completes the predecessor’s assessments. In matters pending before the President of the UODO the successor’s details are best given in a letter quoting the case number. The list of pending matters, the documentation and the list of recommendations are best prepared by the organisation with the predecessor during the notice period while he or she is still working and holding the function. According to the UODO Bulletin the law does not provide for more than one DPO to be designated. The successor therefore takes over the function and pending matters only after the predecessor’s function has ended. The handover is best closed with a dated record listing the materials handed over and any gaps. It is signed by the predecessor, the successor and a representative of the organisation. Correspondence covered by confidentiality only needs to be identified in it by case number without its content.

An external DPO often keeps the records in his or her own tool or on his or her own drive. The tool is sometimes the predecessor’s licence so the account usually cannot be taken over. Access to such a tool usually expires at the end of the service contract. Before the contract ends the organisation obtains a checked export in an editable format with the dates of entries. It then requests that the predecessor delete copies of the documentation and correspondence and confirm this in writing. Where the predecessor leaves in a dispute, the organisation secures a copy of the controller’s documentation from its own systems before announcing the decision. Where the predecessor does not cooperate, the new DPO reconstructs the state of affairs from the organisation’s documents and presents it to the board for confirmation. On the day of the change the organisation removes the predecessor’s access to the functional mailbox and systems. It also withdraws his or her authorisations and powers of attorney, removes rules forwarding mail externally and ends active sessions.

In its set of questions for controllers the UODO asks whether the DPO has drawn up a work plan and how often he or she passes on audit results. It also asks how the controller proceeds when it does not follow the DPO’s guidance or recommendations, for example whether it documents the reasons for not applying them. As good practice the WP 243 guidelines recommend documenting the reasons for not following the DPO’s advice.

What happens to the predecessor’s correspondence and notes

The data protection officer is bound by secrecy or confidentiality concerning the performance of his or her tasks in accordance with Union or Member State law (Article 38(5) GDPR). The WP 243 guidelines link confidentiality to data subjects’ contact with the DPO. Employees may be reluctant to complain to the DPO if the confidentiality of their communications is not guaranteed. Correspondence in the functional mailbox and the predecessor’s working notes may therefore contain information that the board should not read.

In my assessment handing such materials over to the successor falls within the purpose of Article 38(5) because the information stays within the DPO function bound by the same confidentiality. However, the provision contains no exception for a successor and people wrote to a specific DPO. The method of handover is best agreed in advance in the contract with the DPO or in the internal rules governing his or her work. Access to the functional mailbox is best transferred directly to the new DPO. The board is better not given access to it. IT administrators can grant themselves access technically, so any access by them is best limited organisationally and logged. The DPO forwards data subject requests to the controller himself or herself. The personal mailbox of a DPO who is a staff member is best excluded from the usual leaver procedure that forwards mail to the line manager.

Where the new DPO starts

The DPO performs the tasks having due regard to the risk associated with processing operations (Article 39(2) GDPR). According to the WP 243 guidelines this requires prioritising activities and focusing efforts on issues that present higher data protection risks. The first weeks are best spent on pending matters and the highest-risk areas, and the full review is best spread across the work plan.

The DPO reports directly to the highest management level (Article 38(3)), so that is where his or her first report goes. It is advisable for the report to separate the state of affairs found from the action plan. The WP 243 guidelines indicate that DPOs are not personally responsible for non-compliance with data protection requirements. Ensuring compliance and being able to demonstrate it are the responsibility of the controller (Article 5(2) and Article 24(1)) and according to the guidelines also of the processor. Backlogs from before the change therefore remain a matter for the controller or processor and the new DPO should point them out.

Change of DPO step by step — who and by when

Step	Who	Basis and deadline	Exceptions and limits
Ending the predecessor’s function	controller or processor	Article 38(3) GDPR; labour law or the service contract	not for performing the DPO’s tasks
Designating the successor	controller or processor	Article 37(1), (5) and (6) and Article 38(6) GDPR — without a break in the function; act or contract in writing as evidence (UODO)	for a voluntary designation (Article 37(4)) a successor is not mandatory where the criteria in Article 37(1) are still not met and no other provision requires it
Notifying the President of the UODO	the entity that designated the DPO or a proxy	Article 10(1), (2), (4) and (6) of the Act — 14 days from dismissal and from designation; combined form — 14 days from the earlier of these dates	each undertaking in a group or public authority or body sharing a DPO separately (Article 10(5)); deputy — notification in the procedure under Article 10 (Article 11a(3)), according to the UODO on a separate form
Publishing the details	the entity that designated the DPO	Article 37(7) GDPR, Article 11 of the Act — without delay	without a website — at the place of business; the deputy’s details too (Article 11a(3))
Record of processing activities and privacy notices	controller; processor in its own record	Article 30(1)(a) and (2)(a), Article 13(1)(b) and Article 14(1)(b) GDPR	privacy notices unchanged where they give only a functional address in the organisation’s domain
Handover of documentation and pending matters	controller or processor	Article 38(1) and (2) GDPR — involvement in a timely manner, no deadline in days	Article 12(3) deadlines keep running; confidentiality under Article 38(5)

Conclusions and next steps

A change of DPO without a break in the function requires the successor’s designation date and the list of pending matters to be set before the predecessor stops working. With a one-month notice period the successor is best chosen in the first week and the rest of the time spent preparing the handover.

1. Record the reason for ending the function and check whether it is connected with the DPO’s recommendations.
2. Dismiss the predecessor and designate the successor in writing with dates that leave no gap, after checking qualifications and conflicts of interests.
3. Before the day of the change prepare the pending matters, the documentation and the list of unimplemented recommendations with the predecessor, preferably during the notice period. Hand them over to the successor on the day of designation and close the handover with a record.
4. Decide how correspondence addressed to the previous DPO is passed on.
5. On the day of the change remove the predecessor’s access and powers of attorney, request the deletion of copies of documentation and correspondence and give the new contact to the parties to data processing agreements.
6. Update the details without delay on the website, in the record of processing activities and in privacy notices that name the predecessor.
7. Within 14 days of the earlier of the dismissal and designation dates file the notification on the form for the dismissal of the previous and the designation of a new DPO. Check the signatures against the rules of representation, keep the UPP and check whether the change also concerns the deputy.
8. Ask the new DPO for a first report on the state of affairs found and on the work plan.

Related materials

• What should a contract with an external data protection officer contain? — notice period and handover of documentation in the contract.
• What resources must a data protection officer receive? — time, access to information and a deputy DPO.
• What information should the board expect from the DPO? — the DPO’s reports to the board.
• External or internal DPO? What to consider before deciding? — choosing the model before changing the DPO.

Sources

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), consolidated version — Article 5(2), Article 12(3), Article 13(1)(b), Article 14(1)(b), Article 24(1) and (2), Article 30(1) and (2), Article 33(1), (3)(b), (4) and (5), Article 34(2), Article 35(2) and Articles 37 to 39 — eur-lex.europa.eu.
• Act of 10 May 2018 on the Protection of Personal Data, consolidated text as at 18 August 2026 — Articles 8, 10, 11 and 11a (in Polish) — isap.sejm.gov.pl.
• Article 29 Working Party, Guidelines on Data Protection Officers (WP 243 rev.01), endorsed by the European Data Protection Board — sections 2.1, 2.5, 2.6, 3.1, 3.4, 4.4 and 4.5 and question 12 of the annex — ec.europa.eu.
• Judgment of the Court of Justice of the European Union of 22 June 2022, C-534/20 Leistritz, ECLI:EU:C:2022:495 — paragraphs 23 and 28 — curia.europa.eu.
• Personal Data Protection Office (UODO), UODO Bulletin — special issue (materials from the archived UODO website from 2018 to 2022), chapters on the designation and status of the DPO and on notifications to the President of the UODO concerning the DPO (in Polish) — uodo.gov.pl.
• Personal Data Protection Office (UODO), Verification of compliance with the provisions on the data protection officer (in Polish) — uodo.gov.pl and announcement “Effective designation of a DPO is a prerequisite for effective data protection” (in Polish) — uodo.gov.pl.
• Biznes.gov.pl, Notify the dismissal of the previous and the designation of a new data protection officer (under the Personal Data Protection Act – GDPR), responsible institution Personal Data Protection Office (in Polish) — biznes.gov.pl.