DEContact
Applies toEUDEAT

Article 37 GDPR - Obligation to Appoint a DPO

Conditions for appointing a data protection officer under the GDPR.

Definition

Art. 37 GDPR requires a data protection officer (DPO) to be appointed where: (a) the processing is carried out by a public authority or body, (b) the core activities consist of regular and systematic monitoring on a large scale, (c) the core activities consist of large-scale processing of special categories of data (Art. 9) or of personal data relating to criminal convictions and offences (Art. 10). As an EU regulation, Art. 37 GDPR applies in identical wording in Germany and Austria; differences exist only in the supplementary national law and in which supervisory authority is competent (see below). Useful for implementation: a template for the appointment and a catalogue of the DPO's tasks.

Germany and Austria

Germany

In addition to Art. 37(1) GDPR, § 38(1) of the German Federal Data Protection Act (BDSG) requires a data protection officer to be appointed as soon as, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data. Supervision lies with the data protection authorities of the federal states (for the private sector).

Austria

Austria has no equivalent to the 20-person threshold in § 38 BDSG. The obligation to appoint a data protection officer follows directly from Art. 37 GDPR; § 5 of the Austrian Data Protection Act (DSG) sets no additional numerical threshold. The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehoerde).