Article 37 of the GDPR: Designation of a Data Protection Officer (DPO)

· By Bertrand BucelleBertrand Bucelle · 1 min read

Article 37 of the GDPR: Designation of a Data Protection Officer (DPO)

Article 37 of the GDPR Explained

The appointment of a DPO is mandatory when:

  • Processing is carried out by a public authority or body (except for courts acting in their judicial capacity);
  • The core activities consist of large-scale processing operations which require regular and systematic monitoring of data subjects;
  • The core activities consist of large-scale processing of special categories of data or data relating to criminal convictions and offences.

The DPO may be an internal or external staff member, but must be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices.

Why is this article important for your GDPR compliance?

The DPO is a pillar of GDPR compliance. They advise, monitor, train, and act as the point of contact with the French supervisory authority. Their appointment is a guarantee of seriousness and rigour in the management of personal data.

How to comply with GDPR Article 37?

  • Assess whether your organisation is subject to the obligation to appoint a DPO;
  • Choose a competent professional (internal or external);
  • Inform the French supervisory authority of their appointment via the dedicated online service;
  • Provide the necessary resources to enable the DPO to perform their duties.

Examples of Article 37 GDPR application

  • A local authority appoints a shared DPO for several establishments;
  • An insurance company outsources the DPO function to a specialised firm;
  • An e-commerce company chooses an internal DPO responsible for overseeing the compliance of CRM and marketing tools.

Related Resources

Accelerate your compliance in a few clicks

With our all-in-one solution, you can accelerate and ensure your compliance easily:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise awareness among your teams with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now