--- title: 'GDPR: which organizations must appoint a DPO?' url: 'https://argobs.com/en/gdpr-quali-organizzazioni-devono-nominare-un-dpo' markdown: 'https://argobs.com/en/gdpr-quali-organizzazioni-devono-nominare-un-dpo.md' lang: en date: '2021-03-26' description: 'The Data Protection Officer (DPO) is a role introduced by Art. 37 of Regulation (EU) 2016/679 "GDPR". It is a person (an individual, internal or external to an organization, or a legal entity) appointed by the controller or the processor to perform support and oversight, advisory, training and info…' taxonomy: category: - gdpr --- # GDPR: which organizations must appoint a DPO? 26 March 2021 | GDPR The **Data Protection Officer** (**DPO**) is a role introduced by Art. 37 of **Regulation (EU) 2016/679 "GDPR"**. It is a person (an individual, internal or external to an organization, or a legal entity) appointed by the **controller** or the **processor** to perform support and oversight, advisory, training and information functions relating to the application of the GDPR. The DPO’s contact details must be communicated to the **Italian Data Protection Authority (the Garante)** by following a specific online procedure. But which organizations are required to appoint a DPO? **APPOINTMENT REQUIREMENTS** Under Article 37 of the GDPR, the controller and the processor must designate a DPO in any case where: 1. the processing is carried out by a **public authority** or **public body**, except for courts acting in their judicial capacity; 2. the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, scope and/or purposes, require **regular and systematic monitoring of data subjects on a large scale**; or 3. the core activities of the controller or the processor consist of **processing on a large scale of special categories of personal data** pursuant to Article 9 or of personal data relating to criminal convictions and offences referred to in Article 10. In more detail, according to the [FAQs published by the Garante](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/8036793), the following are required to appoint one, by way of example and not exhaustively: credit institutions; insurance companies; credit information systems; financial companies; commercial information companies; auditing firms; debt collection companies; security firms; political parties and movements; trade unions; tax assistance centres (CAF) and welfare advice bureaus (patronati); companies operating in the "utilities" sector (telecommunications, electricity or gas distribution); temporary employment and recruitment companies; companies operating in the healthcare, health prevention and diagnostics sector, such as private hospitals, spas, medical analysis laboratories and rehabilitation centers; call center companies; companies providing IT services; companies providing pay-TV services. In any event, even in cases where the Regulation does not strictly require the designation of a DPO, a **voluntary appointment** is still possible. **CONTACT ARGO** Do you need to appoint a DPO for your organization? Contact us for a quote by emailing or send us a message through the contact form. If you are not sure whether your organization is required to appoint a DPO, write to us or call us and we will provide a free initial consultation. --- ## Navigation - Parent: [News](https://argobs.com/en/news.md) - Previous: [The Record of Processing Activities: what it is for and who must keep it](https://argobs.com/en/il-registro-dei-trattamenti-a-cosa-serve-e-chi-deve-adottarlo.md) - Next: [OVH fire: 4 lessons for businesses](https://argobs.com/en/incendio-ovh-4-lezioni-per-le-aziende.md)