--- title: "Data protection officer (DPO)" description: "Data protection officer under GDPR Article 37(1): when a controller or processor must designate one, and the three cases that trigger the duty." canonical: "https://gencompl.ai/glossary/data-protection-officer-gdpr" language: "en-US" type: "Glossary term" published: "2026-10-14T18:24:26.846Z" modified: "2026-10-14T19:20:01.501Z" --- # Data protection officer (DPO) The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. Also known as: DPO, functionaris voor gegevensbescherming, FG **When must a data protection officer be designated under the GDPR?** Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp) [Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Data protection officer (DPO) - **1.** The controller and the processor shall designate a data protection officer in any case where: - (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; - (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or - (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. ## Defined in / by - [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 37(1) Last updated: 14 October 2026. ## An internal supervisor, not the person who does the work The GDPR never defines the data protection officer in a sentence. It describes the role through three articles: Article 37 says when one must be designated, Article 38 sets the position, and Article 39 lists the tasks. In Dutch the role is the *functionaris voor gegevensbescherming*, usually shortened to FG. Article 39(1) gives the DPO at least these tasks: to inform and advise the controller or processor and its employees, to monitor compliance with the GDPR and the organisation's own policies, to advise on data protection impact assessments when asked, and to cooperate with and act as contact point for the supervisory authority. Article 38(3) requires that the DPO receives no instructions about those tasks and is not dismissed or penalised for performing them. Article 38(6) allows other tasks, as long as they do not cause a conflict of interests. That last point is where schools need care. The Normenkader IBP works with an IBP-verantwoordelijke who runs the day-to-day work on information security and privacy. A DPO who also carries out that work would be monitoring decisions he or she took, which is the kind of conflict Article 38(6) is meant to prevent. Article 37(7) requires the controller to publish the DPO's contact details and communicate them to the supervisory authority. > **What we could not establish** > > The GDPR does not define "public authority or body" in point (a). Whether a given school board falls under it is a question of national law; we have not found a statement from the Autoriteit Persoonsgegevens that settles it for every type of school board. This entry fixes the provision; your counsel decides whether it catches your organisation. ## Questions and answers ### What are the tasks of a data protection officer under the GDPR? Article 39(1) of the GDPR lists at least: informing and advising the controller or processor and its employees, monitoring compliance, advising on data protection impact assessments where requested, cooperating with the supervisory authority and acting as its contact point. ### Can the data protection officer have other tasks under the GDPR? Yes. Article 38(6) of the GDPR allows the data protection officer to fulfil other tasks and duties, provided the controller or processor ensures that they do not result in a conflict of interests. ## Sources - [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016) - [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet) ## Related content ### Regulation - [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.