Last review date: 30 December 2023
Yes.
Are there circumstances in which it is mandatory to appoint a DPO or similar position? If yes, under what circumstances?
☐ the processing is carried out by a public authority or body, except for courts acting in their judicial capacity
☐ the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale
☒ the core activities of the controller or the processor consist of processing on a large scale of special categories of data
☐ the organization employs more than a certain number of individuals in the jurisdiction
☒ other
A DPO must also be appointed: (i) when the controller or processor processes great volumes of personal data (irrespective of its category) and (ii) by public, state or non-state entities and wholly or partially private state-owned entities.
Under Decree N° 64/020, the processing of great volumes of personal data means the processing of personal information of more than 35,000 data subjects.
Last review date: 30 December 2023
☒ Yes
☐ No
If yes, under what circumstances?
☐ the processing is carried out by a public authority or body, except for courts acting in their judicial capacity
☐ the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale
☐ the core activities of the controller or the processor consist of processing on a large scale of special categories of data
☐ the organization employs more than a certain number of individuals in the jurisdiction
☒ other
A DPO must also be appointed: (i) when the controller or processor processes great volumes of personal data (irrespective of its category) and (ii) by public, state or non-state entities and wholly or partially private state-owned entities.
Under Decree N° 64/020, the processing of great volumes of personal data means the processing of personal information of more than 35,000 data subjects.
Last review date: 30 December 2023
Yes.
If yes, what are these requirements?
☒ legal qualifications / experience
☐ other professional qualifications / experience
☐ resident in the jurisdiction
☒ other
According to Decree N° 64/020, the DPO must have knowledge of the law, must specialize in the protection of personal data, and must be accredited. Considering that one of the functions of the DPO is to act as the link to Regulatory and Personal Data Control Unit (Unidad Reguladora y de Control de Datos Personales), it is highly advisable for the DPO to speak Spanish.