GDPR Article 37: designation of the data protection officer

Article 37 is the provision that decides whether you must appoint a data protection officer, and it is shorter than its reputation suggests. Seven paragraphs cover when designation is compulsory, who may share one, what the person needs to know, and what you have to publish afterwards.

The three mandatory triggers

Article 37(1) says the controller and the processor shall designate a data protection officer in any case where:

(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.

These are alternatives, not cumulative conditions. Note also that Article 37(1) binds processors as well as controllers, which is regularly missed by vendors who assume the duty sits only with their customers.

What "core activities" is doing

Both (b) and (c) hang on the phrase "core activities". It is the difference between processing that is part of what you do and processing that merely supports it. Payroll and internal IT are usually support functions even at a large employer. Behavioural advertising, fraud scoring across a user base, location tracking in a consumer app, or running a health platform are core, because the processing is the service rather than an overhead of running it.

Neither "large scale" nor "regular and systematic" is defined in the Article itself, which is why the assessment has to be documented rather than asserted.

Sharing, outsourcing and qualifications

Article 37(2) allows a group of undertakings to appoint a single data protection officer, provided the DPO is easily accessible from each establishment. Article 37(3) gives public authorities the equivalent, allowing one DPO for several authorities or bodies, taking account of their organisational structure and size.

Article 37(4) covers the cases outside paragraph 1: the controller, processor, or associations and other bodies representing categories of them, may designate a DPO, or shall where required by Union or Member State law. Some Member States legislate lower national thresholds, so a company outside Article 37(1) can still be caught locally.

Article 37(5) sets the standard for the person. The DPO shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. Article 37(6) then confirms the DPO may be a staff member, or may fulfil the tasks on the basis of a service contract. Outsourcing is expressly allowed.

The publication duty

Article 37(7) is one sentence and two obligations: the controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. Publishing them in a privacy notice without notifying the regulator only does half of it.

Where this connects

The DPO sits alongside the other accountability duties. If you are carrying out high-risk processing you will also owe a data protection impact assessment under Article 35, and Article 35(2) requires you to seek the DPO's advice when doing one. Your records of processing activities under Article 30 are usually what the DPO works from. For the practical version of the question rather than the statutory text, see do I need a DPO.

There is no headcount threshold in Article 37

A recurring misreading is that a data protection officer becomes mandatory once an organisation passes some number of employees. Article 37(1) contains no number. Its three triggers turn on who is doing the processing and what the core activities consist of, not on size, turnover or headcount.

The number people are remembering belongs to a different article. Article 30(5), on records of processing activities, reads:

"The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."

That is a partial exemption from the record-keeping duty, subject to three broad exceptions that most active businesses meet anyway, and it has nothing to do with designating a DPO. Importing "250 persons" into Article 37 produces the wrong answer in both directions: a forty-person adtech company whose core activity is large-scale behavioural monitoring falls squarely inside Article 37(1)(b), while a thousand-person manufacturer whose processing is ordinary employee and customer administration may fall outside Article 37(1) entirely.

Article 37(4) covers the remaining case. In cases other than those referred to in paragraph 1, a controller or processor, or an association or other body representing categories of them, "may or, where required by Union or Member State law shall, designate a data protection officer". So voluntary designation is expressly contemplated, and national law can add mandatory cases the Regulation itself does not create. Germany has long done exactly that, which is why a headcount rule genuinely does apply to some controllers, just not by force of Article 37(1).

Next step

If you are not sure whether your monitoring or special-category processing is at the scale Article 37(1) contemplates, the free 2-minute Obligation Scan works out whether the GDPR applies to you and which accountability duties, including a DPO, come with it. The GDPR compliance hub puts the duties in order.

The official text of Article 37, paragraph by paragraph

The consolidated text of Regulation (EU) 2016/679 on EUR-Lex reads as follows.

37(1). "The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10."

37(2). "A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment."

37(3). "Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size."

37(4). "In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors."

37(5). "The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39."

37(6). "The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract."

37(7). "The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority."

One textual note for anyone working from an unofficial copy: in the EUR-Lex consolidated version, Article 37(1)(c) is marked with the corrigendum flag, meaning the wording above is the corrected text rather than the one printed in the original Official Journal publication. The base text resumes at 37(2). Copies that predate the corrigendum can differ at exactly the point where the large-scale special-category trigger is defined, which is the limb most controllers actually test themselves against.