11. Data Protection Officer
An organisation is required to appoint a designated data protection officer (DPO) where:
-
the processing is carried out by a public authority or body;
-
its core activities consist of processing operations, which require regular and systematic monitoring of data subjects on a large scale; or
-
its core activities consist of processing on a large scale of special categories of data or personal data relating to criminal convictions and offences.
If the firm falls into one or more of the above categories, it should consider the qualifications required to fill the DPO role on the and make a . See also guidance from the EDPB: