Article 39 GDPR - Tasks of the data protection officer

1. The data protection officer shall have at least the following tasks:
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d) to cooperate with the supervisory authority;
(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

Relevant Recitals

Frequently Asked Questions

Short answers to common questions about this provision. They are general information and not legal advice.

Paragraph 1 assigns at least five tasks. The officer informs and advises the controller or processor and the employees carrying out processing, monitors compliance with the Regulation, other data protection provisions and internal policies, provides advice on request regarding the data protection impact assessment and monitors its performance under Article 35, cooperates with the supervisory authority, and acts as the contact point for that authority.

No. The opening words of paragraph 1 state that the officer shall have at least the listed tasks, so the controller or processor may entrust further duties. Article 38(6) permits such additional tasks provided they do not give rise to a conflict of interests.

Yes. Point (b) of paragraph 1 covers compliance with the Regulation, with other Union or Member State data protection provisions and with the internal policies of the controller or processor, and expressly includes the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits.

Under point (c) of paragraph 1 the officer provides advice where requested as regards the assessment and monitors its performance pursuant to Article 35. The corresponding duty of the controller to seek that advice where an officer is designated is laid down in Article 35(2).

Paragraph 2 directs the officer to have due regard, in performing the tasks, to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing. The tasks are therefore to be performed on a risk-based footing rather than with uniform intensity across all operations.