Last review date: 27 December 2024
Yes.
Yes.
If yes, under what circumstances?
☒ the processing is carried out by a public authority or body, except for courts acting in their judicial capacity
☒ the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale
☒ the core activities of the controller or the processor consist of processing on a large scale of special categories of data
Last review date: 27 December 2024
Yes.
If yes, what are these requirements?
☒ legal qualifications / experience
☒ other professional qualifications / experience
According to the GDPR, a DPO shall possess the professional qualities and expert knowledge of data protection law and practice enabling them to fulfil their role.
According to the WP29 guidelines, the level of expertise depends on the sensitivity, volume and complexity of data processed and whether data transfers are systematic or occasional. The DPO shall have an in-depth understanding of the GDPR and expertise in national and EU laws, knowledge of the business sector of the organization and sufficient understanding of processing operations, information security and information systems.