Data Protection Officer
A Data Protection Officer (DPO) must be appointed when particularly sensitive data is processed, a Data Protection Impact Assessment (DPIA) is required, or the core activity of the company involves extensive processing of personal data.
Additionally, some EU countries have regulations that require a DPO if a certain number of individuals in the company are constantly engaged in the automated processing of personal data (e.g., 20 in Germany).
A Data Protection Officer (DPO) can be any individual who possesses the necessary expertise and reliability. The person must be able to implement the legal requirements of the GDPR and must not have a conflict of interest, meaning they should not be in a position where they decide on the purposes and means of data processing. Both external and internal individuals can assume this role.
Is the Data Protection Officer (DPO) liable for data protection issues and the proper implementation of the GDPR?
The responsibility and liability for compliance with data protection laws generally lie with the company or its management. The Data Protection Officer (DPO) is not personally liable for data protection violations but provides advisory and monitoring support. The management remains responsible for the implementation and adherence to data protection requirements.
Whether an external or internal Data Protection Officer (DPO) is more suitable depends on the individual circumstances of the company. An external DPO often brings specialized expertise and experience and can act more objectively. An internal DPO, however, is more integrated into company processes, which can offer advantages in implementing internal procedures. Often, an external DPO is appointed with the belief that liability can be outsourced. However, this assumption is incorrect. The liability for data protection remains with the management and cannot be outsourced to third parties, either inside or outside the company.
Do I need to report the Data Protection Officer (DPO) to a supervisory authority, and how does this reporting work?
Yes, the Data Protection Officer (DPO) must be reported to the competent data protection authority in the country where the company is based. The procedure varies by country, but the correct process for each country can usually be identified through a simple internet search. Here are some examples:
Data Protection Officers can be reported to the data protection authority by email at dsb@dsb.gv.at or by mail to “Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien.”
The report should include the name/description and contact details of the Data Protection Officer, as well as the designation of the data controller.
More information on reporting the Data Protection Officer in Austria can be found here: https://dsb.gv.at/rechte-pflichten/datenschutzbeauftragter.
In Germany, Data Protection Officers must be reported to the supervisory authority of the respective federal state. The links to the respective online reporting portals for each state can be found here: