EUGDPRDpo GovernanceEASYFree question
Under Article 37, when is the appointment of a DPO mandatory?
- A.For all organisations regardless of size
- B.When processing is carried out by a public authority, when core activities require large-scale regular and systematic monitoring, or when core activities involve large-scale processing of special category data
- C.Only for organisations with more than 500 employees
- D.Only when the supervisory authority orders it
Why B is correct
Article 37(1) makes DPO appointment mandatory in three cases: (a) public authorities/bodies (except courts), (b) core activities requiring regular and systematic large-scale monitoring of individuals, and (c) core activities involving large-scale processing of special category or criminal data.
Know someone studying for GDPR? Send them this one.