Set by the law · GDPR Art. 37(1)
Data protection officer
In plain English
An independent expert who advises on and monitors GDPR compliance. Public bodies must appoint one, as must organisations whose core work involves large-scale monitoring of people or large-scale sensitive data.
The official text
The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities … consist of processing on a large scale of special categories of data
The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks.
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation … (b) to monitor compliance with this Regulation
78 decisions on Fino cite Article 37 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.