Does our company need a data protection officer?

Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., only in certain cases. They are public authorities, and organisations whose core activities consist of large-scale regular and systematic monitoring of people or large-scale processing of special categories of data, such as health data. Many mid-sized companies fall outside those cases, but national law can add more. In Germany, section 38 of the BDSG requires a data protection officer where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data, and in some other cases. Check your own country’s law. Even without a duty, someone must own data protection, and a named contact helps when a breach clock is running. If you appoint one, the officer must be involved in data protection matters in good time, act independently and report to the highest management level. A security tool does not change whether you need one, although network monitoring is a topic the officer should review. NetSenX prepares a GDPR breach notification draft for whoever handles that role, from the Starter plan.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics