The Data Protection Officer (DPO) is a role introduced by Art. 37 of Regulation (EU) 2016/679 "GDPR". It is a person (an individual, internal or external to an organization, or a legal entity) appointed by the controller or the processor to perform support and oversight, advisory, training and information functions relating to the application of the GDPR.
The DPO’s contact details must be communicated to the Italian Data Protection Authority (the Garante) by following a specific online procedure.
But which organizations are required to appoint a DPO?
APPOINTMENT REQUIREMENTS
Under Article 37 of the GDPR, the controller and the processor must designate a DPO in any case where:
- the processing is carried out by a public authority or public body, except for courts acting in their judicial capacity;
- the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, scope and/or purposes, require regular and systematic monitoring of data subjects on a large scale; or
- the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data pursuant to Article 9 or of personal data relating to criminal convictions and offences referred to in Article 10.
In more detail, according to the FAQs published by the Garante, the following are required to appoint one, by way of example and not exhaustively: credit institutions; insurance companies; credit information systems; financial companies; commercial information companies; auditing firms; debt collection companies; security firms; political parties and movements; trade unions; tax assistance centres (CAF) and welfare advice bureaus (patronati); companies operating in the "utilities" sector (telecommunications, electricity or gas distribution); temporary employment and recruitment companies; companies operating in the healthcare, health prevention and diagnostics sector, such as private hospitals, spas, medical analysis laboratories and rehabilitation centers; call center companies; companies providing IT services; companies providing pay-TV services.
In any event, even in cases where the Regulation does not strictly require the designation of a DPO, a voluntary appointment is still possible.
CONTACT ARGO
Do you need to appoint a DPO for your organization? Contact us for a quote by emailing info@argobs.com or send us a message through the contact form. If you are not sure whether your organization is required to appoint a DPO, write to us or call us and we will provide a free initial consultation.