Can a group of companies appoint a single DPO?
- A.Yes, a group of undertakings may designate a single DPO provided the DPO is easily accessible from each establishment under Article 37(2)
- B.Only with the Commission's approval, citing Article 37(2), which prohibits a group of undertakings from sharing a single DPO under any circumstances
- C.Only if all companies are in the same country, under Article 37(3), which requires a single DPO to be appointed separately for each subsidiary in a corporate group
- D.No, each company must have its own DPO
Why A is correct
Article 37(2) permits a group of undertakings to appoint a single DPO provided that the DPO is easily accessible from each establishment.
Know someone studying for GDPR? Send them this one.