GDPR Art. 37 EN

Designation of the data protection officer

Supervisory Authorities

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.
The controller and the processor shall designate a data protection officer in any case where:¶

Processors Supervisory Authorities Controllers 11
1. a)
  the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; ¶
  Public Authority Public Sector
2. b)
  the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or ¶
  Monitoring Processors Controllers
3. c)
  the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. ¶
  Special Categories of Data Criminal Data Types of Special Categories of Personal Data
2.

A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.¶

Supervisory Authorities 4
3.

Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size.¶

Public Authority Public Sector Processors 5
4.

In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.¶

Processors Supervisory Authorities Controllers 1
5.

The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.¶

Supervisory Authorities 9
6.

The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.¶

Processors Supervisory Authorities Controllers 5
7.

The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.¶

Processors Supervisory Authorities Supervision 3

Enforcement

Cited in 62 fines totalling €6.7M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (37) · median fine €6,000 · see all enforcement for Art. 37 →

Connections by provision

37(1) 6 Case Law 5 Guidance .md

Case Law 6

Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶17 Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting ¶121 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶16 Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h

Guidance 5

Guidelines 01/2023 on Article 37 Law Enforcement Directive Guidelines 07/2020 on the concepts of controller and processor in the GDPR Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation ¶40 Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR

37(1)(a) 4 Guidance .md

Guidance 4

Guidelines 01/2023 on Article 37 Law Enforcement Directive Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 Statement 04/2021 on international agreements including transfers EDPB contribution to the 6th round of consultations on the draft Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime

37(1)(b) 5 Case Law 3 Guidance .md

Case Law 5

Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h Spanish court reviews DPA decision on KFC Spain website privacy information and DPO Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting ¶8 Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting ¶8 Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h

Guidance 3

Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 Guidelines 01/2023 on Article 37 Law Enforcement Directive Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms

37(2) 2 Case Law 2 Guidance .md

Case Law 2

Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶121 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment

Guidance 2

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro Guidelines 01/2023 on Article 37 Law Enforcement Directive

37(3) 3 Case Law 2 Guidance .md

Case Law 3

Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶148 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶126 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment

Guidance 2

Guidelines 01/2023 on Article 37 Law Enforcement Directive EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

37(4) 1 Guidance .md

Guidance 1

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

37(5) 8 Case Law 1 Guidance .md

Case Law 8

Order of the Vice-President of the Court of 14 July 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Independence of the Izba Dyscyplinarna (Disciplinary Chamber) of the Sąd Najwyższy (Supreme Court, Poland) – Charter of Fundamental Rights of the European Union – Article 47 – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of quest Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- ¶32 Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting ¶17 Order of the Vice-President of the Court of 14 July 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Independence of the Izba Dyscyplinarna (Disciplinary Chamber) of the Sąd Najwyższy (Supreme Court, Poland) – Charter of Fundamental Rights of the European Union – Article 47 – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of quest ¶17 Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R ¶17 Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R-

Guidance 1

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

37(6) 4 Case Law 1 Guidance .md

Case Law 4

Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h ¶23 Judgment of the Court (First Chamber) of 22 June 2022.#Leistritz AG v LH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Second sentence of Article 38(3) – Data protection officer – Prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on h ¶23 Judgment of the Court (Sixth Chamber) of 9 February 2023.#X-FAB Dresden GmbH & Co. KG v FC.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 38(3) – Data protection officer – Prohibition on dismissing data protection officer for performing his or her tasks – Requirement for functional independence – National legislation prohibiting

Guidance 1

EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro

37(7) 3 Guidance .md

Guidance 3

Recommendations 1/2025 on the 2027 WADA World Anti-Doping Code Opinion 15/2025 on the draft decision of the Austrian Supervisory Authority (AT SA) regarding the certification criteria of BDO Consulting GmbH ¶56 Recommendations 1/2025 on the 2027 WADA World Anti-Doping Code

Related across sources

News ANSPDCP (Romania) - ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL News Datatilsynet (Norway) - 23/00435-62 News VG Berlin - 42 K 73/25 News ANSPDCP (Romania) - AMATO BESTSELLER S.R.L. News Datatilsynet (Denmark) - 2023-31-0321 News DPC (Ireland) - IN-19-9-4