GDPR DPO: Roles and Responsibilities Guide

Under Article 37 GDPR, a DPO is mandatory for public authorities, where core activities require regular and systematic monitoring of data subjects on a large scale, and where core activities involve large-scale processing of special data categories. In Germany, Section 38 BDSG adds: a DPO is required when at least 20 persons are constantly engaged in automated processing of personal data or when a Data Protection Impact Assessment is mandatory.

The DPO informs and advises the controller and employees on GDPR compliance, monitors adherence to data protection regulations, advises on Data Protection Impact Assessments, cooperates with the supervisory authority and serves as a contact point for data subjects. Importantly, the DPO is not personally liable for violations – responsibility lies with the organisation.

The DPO is the legally mandated role under Articles 37–39 GDPR with independence from instructions, dismissal protection and a direct reporting line to senior management. The data protection coordinator is not a legally defined role but an organisational complement: they support the DPO operationally, coordinate data protection measures across departments and serve as a liaison between the DPO and day-to-day business.

An external DPO is particularly suitable for SMEs without internal data protection expertise, when conflicts of interest arise with internal candidates (e.g. IT manager, CEO), or when specialised industry knowledge is required. Advantages include no training costs, no dismissal protection risk, broader practical experience and an independent perspective. The external DPO must meet the same qualification requirements as an internal one.

Article 37(5) GDPR requires professional qualifications, expert knowledge of data protection law and practice, and the ability to fulfil the tasks referred to in Article 39. In practice this means: thorough knowledge of the GDPR, national data protection laws and sector-specific regulations, technical understanding of data processing operations, and communication skills for training and advisory activities.

Yes. Article 37(7) GDPR requires the controller to publish the DPO contact details and communicate them to the supervisory authority. In Germany, this notification goes to the relevant state data protection authority. Contact details must also be accessible to data subjects, for example on the company website and in the privacy policy.

Article 38 GDPR guarantees the DPO independence from instructions in task fulfilment, protection from penalties for performing duties, and a direct reporting line to the highest management level. In Germany, Section 38(2) in conjunction with Section 6(4) BDSG grants additional dismissal protection: removal or termination is only permissible for cause and not until one year after the end of the appointment.