Article 38 of the GDPR: Status of the Data Protection Officer (DPO)

· By Bertrand BucelleBertrand Bucelle · 2 min read

Article 38 of the GDPR: Status of the Data Protection Officer (DPO)

Article 38 of the GDPR explained

The controller or the processor must ensure that:

  • The DPO is involved in due time in all matters relating to data protection;
  • They have the necessary resources for the performance of their tasks (time, budget, training...);
  • They do not receive any instructions regarding the performance of their tasks;
  • They are not penalised or dismissed for performing their tasks;
  • They perform their duties with complete independence, without conflict of interest.

Data subjects may freely contact the DPO for any question relating to the processing of their data.

Why This Article Matters for Your GDPR Compliance?

Respect for the DPO's status is a condition for the validity of their designation. A DPO who is hierarchically dependent or prevented from acting freely would compromise the organisation's compliance.

How to comply with Article 38 of the GDPR?

  • Formalise the DPO's independence in their contract or letter of appointment;
  • Ensure they have direct access to management and the necessary information;
  • Provide a budget and resources appropriate to their role;
  • Avoid any conflicts of interest (the DPO must not make decisions regarding data processing themselves).

GDPR Article 38 Application Examples

  • An internal DPO attends management committees and is consulted on any new digital project;
  • A company entrusts the DPO function to an external entity via a dedicated service contract;
  • The DPO has direct access to all processing operations and can meet with the French supervisory authority independently.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance easily:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise awareness among your teams with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now