Public sector · GDPR

Public sector — GDPR: processing citizens' data

The public sector processes citizens' data at very large scale, often on the basis of a public interest mission. The GDPR requires solid legal bases, transparency, DPIAs and security, with a heightened expectation of exemplary conduct. This guide details these obligations and provides a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Public authorities, operators, and public institutions are data controllers.
  • Ground the processing.
  • Conduct DPIAs.
  • Governing automated decisions.
  • Specific caps may apply to public bodies under national law.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

The public sector generally acts on the basis of a public interest mission or a legal obligation. Processing operations are large-scale (civil status, social, tax) and sometimes sensitive (public health).

Automated administrative decisions are regulated: information and the possibility of human intervention are required.

Is the 'Public sector' concerned?

Public authorities, operators and public institutions are data controllers. Scale and sensitivity raise the level of requirements.

The local level is covered on the 'Local Authority' page.

Detailed obligations

Ground the processing

Identify the legal basis (public interest mission, legal obligation) and inform users.

Conduct DPIAs

Conduct impact assessments for high-risk processing activities.

Governing automated decisions.

Ensure information provision and human intervention for administrative decisions with significant effect.

Mastering retention periods and security

Apply appropriate retention periods and security commensurate with the stakes.

Appoint a DPO

The appointment of a Data Protection Officer is mandatory for public bodies.

Sanctions & risks

Specific caps may apply to public bodies under national law. The key issue is citizens' trust.

Common mistakes in the sector

  • 1Unclear legal basis. Failing to link processing activities to a clearly defined purpose.
  • 2DPIA omitted. Ignoring impact assessments for high-risk processing.
  • 3Ungoverned decisions. Automate decisions without safeguards.
  • 4DPO missing. Failing to appoint a DPO where mandatory.

Practical case

A public body deploys an online application process for financial assistance. It bases the processing on its public interest mission, informs users, carries out a DPIA, and provides for human intervention on unfavourable decisions.

Compliance roadmap

  1. 1

    Map. Inventory citizen processing activities.

  2. 2

    Qualify. Verifying legal bases and information.

  3. 3

    DPIA. Carry out the necessary assessments.

  4. 4

    Secure. Appropriate retention periods and security.

  5. 5

    DPO. Appoint and equip the delegate.

Frequently asked questions

Yes: public authorities and public bodies must appoint a DPO.

Back to the Public sector guidePublic sector & NIS2 Public sector & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to public sector.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the public sector sector secured their compliance with DCO.

See testimonials