Resources
Reference materials
Regulation
Professional services
11. Data Protection Officer
An organisation is required to appoint a designated data protection officer (DPO) where:
- the processing is carried out by a public authority or body;
- its core activities consist of processing operations, which require regular and systematic monitoring of data subjects on a large scale; or
- its core activities consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences.
If the firm falls into one or more of the above categories, it should consider the qualifications required to fill the DPO role on the Data Protection Commission website and make a notification of the appointee to the DPC. See also guidance from the EDPB
Right column
GDPR Guidance
Browse other Law Society guidance on the General Data Protection Regulation (GDPR) through the links below.
- 1. Understanding obligations
- 2. Being accountable
- 3. Communicating with staff and service users
- 4. Data subject rights
- 5. Data Subject Access Requests (DSARs)
- 6. Lawful basis for processing personal data
- 7. Consent
- 8. Processing Children's Data
- 9. Data Breach Protocol
- 10. Data Protection Impact Assessment
- 11. Data Protection Officer
- Considering appointing a DPO - issues to consider
