This area answers three questions: do we need a data protection officer? Who is it, and has the appointment been notified? And which details about us as the controller belong in the record of processing, privacy notices and notifications? It also checks whether a representative in the Union is needed.

At a glance

Included from: Enterprise
Where in the app: GDPR → Govern → Data protection officer
Output: Result of the mandatory check, DPO profile, controller master data, EU representative status
Legal basis: Art. 27, 37–39 GDPR; Sec. 38 BDSG
API: /api/v1/dpo

Mandatory check: is a DPO required?

If any criterion is met, the result is "required". If all are answered no and fewer than 20 persons are involved, it is "not required"; otherwise "unclear".

Criterion	Basis
Public authority or body	Art. 37(1)(a) GDPR
Core activity: regular and systematic monitoring on a large scale	Art. 37(1)(b) GDPR
Core activity: large-scale processing of special categories (Art. 9) or criminal-offence data (Art. 10)	Art. 37(1)(c) GDPR
As a rule at least 20 persons constantly engaged in automated processing (including part-timers, trainees, freelancers)	Sec. 38(1) sentence 1 BDSG
Processing subject to a data protection impact assessment, regardless of headcount	Sec. 38(1) sentence 2 BDSG
Commercial processing for transfer, anonymised transfer or market or opinion research, regardless of headcount	Sec. 38(1) sentence 2 BDSG

DPIA obligation is read from the registers

Whether processing subject to a DPIA exists is determined not only from your answer but also from DPIA records and processing records with the screening result "DPIA required". The result is a professional assessment to support the decision, not legal advice.

The DPO profile

Name and contact details: the contact that also belongs in the privacy notices.
Internal or external, with the service provider for an external appointment; group DPO with a note on accessibility (Art. 37(2)).
Date of appointment, date of notification to the supervisory authority and publication of the contact details (Art. 37(7)).
Evidence of expertise (Art. 37(5)) and conflict-of-interest check with date and note (Art. 38(6)).
Tasks under Art. 39 and owners per task.

Controller: master data

Legal name, structured address, contact, optional commercial register entry, parent company and competent supervisory authority (choice of the state authorities under Sec. 40 BDSG and the BfDI). The app uses these details for the record of processing (Art. 30(1)(a)), privacy notices (Art. 13(1)(a)) and notifications to the authority.

Representative in the Union (Art. 27 GDPR)

Only for controllers or processors without an establishment in the Union whose processing falls under Art. 3(2) GDPR. The app asks:

Is there an establishment in the Union? Then no representative is needed.
Does an exception under Art. 27(2) apply: occasional processing unlikely to result in a risk (point a) or a public authority (point b)?
If needed: name, address in the Union and the member state where data subjects are located (Art. 27(3)).
The result (not required, designated, required but not designated, check open) appears in the record of processing and in the GDPR checklist.