GDPR Article 37 makes a Data Protection Officer (DPO) mandatory for public authorities and where core activities involve large-scale, regular and systematic monitoring of people, or large-scale processing of special-category or criminal-offence data. Everyone else may appoint one voluntarily, unless national law requires it. The rule has applied since 25 May 2018.
This guide is for compliance managers and DPOs in GCC and EU organisations.
How do you know if your organisation needs a DPO?
Article 37(1) of Regulation (EU) 2016/679 covers public authorities and bodies, except courts acting in their judicial capacity. Private organisations are caught only through their core activities.
The working test is in the Guidelines on DPOs (WP243 rev.01), revised on 5 April 2017 and endorsed by the European Data Protection Board (EDPB) on 25 May 2018. Core activities are the key operations you exist to perform. A hospital processing health data and a security firm running surveillance both qualify. Payroll and standard IT support are ancillary.
No number defines "large scale". WP243 weighs the number of people, the volume and range of data, duration and geographic reach. Its examples include a hospital's patient data, a bank's or insurer's customer data and a telecom operator's traffic and location data. An individual physician's patient files are not large scale.
The monitoring must be regular, meaning ongoing or recurring, and systematic, meaning methodical or part of a plan. It is not limited to online tracking. WP243 lists credit scoring, fraud and anti-money-laundering profiling, loyalty programmes, app location tracking, behavioural advertising and CCTV.
Two readings catch people out. WP243 reads the "and" in Article 37(1)(c) as "or", so either data type is enough. Controller and processor are also assessed separately. A small shop using an advertising processor needs no DPO, while the processor serving many clients does.
Unless the answer is obvious, WP243 says to document your analysis and update it when activities change. If you appoint a DPO voluntarily, Articles 37 to 39 apply in full.
Do national laws add to Article 37?
They can, under Article 37(4). Section 38(1) of Germany's Federal Data Protection Act (BDSG) requires private organisations to appoint a DPO if they, as a rule, constantly employ at least 20 persons in automated processing of personal data. Headcount does not matter where processing needs a DPIA, or where data is processed commercially for transfer or for market or opinion research.
Spain's LOPDGDD Article 34(3) requires notice to the AEPD of any DPO appointment or removal within ten days. These are examples only. Check the law in each Member State where you have an establishment.
Who can be your DPO, and who cannot?
Article 37(5) requires expert knowledge of data protection law and practice, matched to your processing. The GDPR names no required certificate. The DPO can be staff or a contractor, and a group may share one who is easily accessible from each establishment.
Other duties are allowed if they create no conflict of interests (Article 38(6)). In X-FAB Dresden (C-453/21, 9 February 2023), the Court of Justice held that a conflict may exist where other duties lead the DPO to determine the objectives and methods of processing. National courts decide case by case. The Court left the works council chair in that case to the German court.
WP243's rule of thumb lists chief executive, operating, financial and medical officers, and heads of marketing, HR and IT, as likely conflicts. The EDPB also treats your Article 27 EU representative as incompatible with being your external DPO.
In Decision 18/2020 of 28 April 2020, the Litigation Chamber of Belgium's Data Protection Authority fined an organisation EUR 50,000. Its DPO was also director of audit, risk and compliance. Heading those three departments meant setting the purposes and means of their processing, so the Chamber found an Article 38(6) conflict, even though the roles were described as advisory.
What do you owe the DPO, and can you dismiss one?
Article 38 requires you to involve the DPO in time on all data protection issues and to give them resources, access and training. The DPO takes no instructions on their tasks, cannot be dismissed or penalised for performing them, and reports to the highest management level.
WP243 adds practice points. Record why you rejected the DPO's advice, and set a time percentage and work plan for a part-time DPO. Indirect penalties, such as a blocked promotion, count, and so does a threat.
In Leistritz (C-534/20, 22 June 2022), a company dismissed its head of legal affairs, who was also its DPO, in a restructuring that outsourced both roles. German courts held the dismissal void, because German law allows it only for just cause. The Court of Justice held that EU law permits such protection for a staff DPO, even where the reason is unrelated to the DPO's tasks. X-FAB set the limit: such protection must still allow removal of a DPO who lacks expertise, does not perform the tasks properly or has a conflict.
Article 39 sets the minimum tasks: inform and advise, monitor compliance, advise on DPIAs, and cooperate with the authority as its contact point. Compliance stays with the controller under Article 24, so the DPO is not personally responsible for failures.
How do GDPR, Saudi and UAE DPO rules compare?
Article 37 has no exception for organisations outside the EU. If Article 3(2) brings your processing into scope, the test applies to it. Typical Gulf cases that fit WP243 examples are a bank or insurer, a hospital group, a telecom operator and an app with location tracking.
| Point | GDPR, Articles 37 to 39 | Saudi PDPL Implementing Regulation, Article 32 | UAE Decree-Law 45 of 2021, Articles 10 to 12 |
|---|---|---|---|
| Who must appoint | Public authorities. Core activities with large-scale regular and systematic monitoring, or large-scale special-category or criminal-offence data | Public entities with large-scale processing. Primary activities needing regular and systematic monitoring. Core activities based on sensitive data | High risk from new technology or data volume. Systematic assessment of sensitive data, including profiling. Large volumes of sensitive data |
| Who may serve | Staff or a service contractor | An executive, an employee or an external contractor | An employee or authorised person, inside or outside the State |
| Link to the authority | Contact details published and sent to the authority | DPO is the direct contact point with the authority | Contact details notified to the Data Office |
| Detailed rules | WP243 rev.01 | SDAIA DPO appointment rules, issued 27 August 2024 | Article 10(4) leaves the criteria to the Executive Regulation |
Saudi Article 32(2) allows an executive to be the DPO, while WP243 lists senior roles as typical conflicts. Saudi Article 32(3)(d) also makes breach notification a DPO task, whereas GDPR Article 33 gives it to the controller. Our guide to Saudi PDPL enforcement covers the SDAIA rules.
What do authorities find, and what will they ask to see?
The EDPB's 2023 coordinated enforcement action drew 17,490 replies across 25 authorities. Its report, adopted on 16 January 2024, found that a median of only 45.82% of DPOs worked full time. A median of 13.82% of respondents per Member State said the DPO receives instructions. In four Member States, 30% or more said the DPO is not expected to report to top management at all.
Spain's AEPD fined Glovo EUR 25,000 in a 2020 decision (PS/00417/2019) for having no DPO despite large-scale processing. A data protection committee doing the DPO's work did not count. Articles 37 to 39 fall in the Article 83(4) tier: up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
Expect to show these records:
- A dated Article 37 analysis, with any national check.
- The appointment letter or service contract, and an external DPO's named lead and client load.
- The published contact details and the authority's receipt.
- A conflict assessment against a list of incompatible roles.
- DPIA files with the DPO's advice, the time allocation, and board minutes on the annual DPO report.
For a management-system approach to privacy, see our guide to ISO/IEC 27701.
How AGS can help
The EU GDPR Data Protection Officer (DPO) Management System holds 282 documents in editable Microsoft Word and Excel files. It includes an Article 37 Applicability Assessment, a DPO Required or Not Required Decision Record and a DPO Conflict-of-Interest Assessment. It also has a DPO Instruction and Interference Register, an Unaccepted DPO Advice Record and an Annual DPO Report to Highest Management. It covers the GDPR only and does not supply a DPO.
Frequently asked questions
Does the DPO have to be based in the EU?
WP243 recommends an EU-based DPO, even for organisations with no EU establishment. It accepts that where you have none, a DPO outside the EU may sometimes work more effectively.
Do we have to publish the DPO's name?
No. Publishing the name may be good practice, and you and the DPO decide. Giving it to the supervisory authority is essential. A breach notification must also include it (Article 33(3)(b)).
Can we sign a data processing agreement with our external DPO?
Be careful. One authority in the EDPB's 2023 action found that treating the external DPO as your processor could breach the independence rule in Article 38(3).
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with or endorsed by the European Data Protection Board, SDAIA, the UAE Data Office or any supervisory authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
