Category
Data Protection Officer
Everything about the DPO: when it is mandatory, functions, how to register with the AEPD, and the advantages of an external Data Protection Officer.
The Data Protection Officer (DPO) is the figure responsible for supervising GDPR compliance within an organisation. Appointment may be mandatory in certain cases set out in the GDPR and in Article 34 of the LOPDGDD; the specific obligation depends on the individualised analysis of each organisation.
The DPO acts as the official point of contact between the organisation and the Spanish Data Protection Agency (AEPD), provides internal advice on data processing, supervises impact assessments and coordinates the response to security breaches. This is not a purely formal role: an organisation that is required to have a DPO and does not appoint one faces direct sanctions.
In this section you will find complete guides on when a DPO is mandatory, the difference between an internal and external DPO, how to notify the AEPD of the appointment and what responsibilities the designation entails.
Articles on Data Protection Officer
AEPD and DPO: complete guide to the Data Protection Officer
Complete guide to the relationship between the AEPD and the Data Protection Officer. Functions, registration, sanctions and how Certix can help.
Data Protection Officer: what it is, functions and when it is mandatory
If your organisation handles personal data, you may need a Data Protection Officer. We explain what it is, what they do and when appointment is compulsory.
Frequently asked questions about data protection officer
When is it mandatory to appoint a Data Protection Officer?
The GDPR sets out three general scenarios: public bodies, organisations that process special-category data at scale (health, biometric, ideological…) and those that carry out systematic monitoring of individuals at scale (art. 37 GDPR). Art. 34 LOPDGDD adds further mandatory cases in Spain for specific sectors — financial institutions, insurers, educational centres, private security firms, professional associations, and others — except for health professionals practising as sole practitioners. The specific obligation depends on the individualised analysis of each organisation; this information is indicative and each case must be studied individually.
What are the advantages of an external DPO over an internal one?
An external DPO provides objective independence, up-to-date technical knowledge without the cost of ongoing internal training, and immediate coverage without the need to create a new post. Furthermore, having no internal hierarchical ties, they can perform their function with greater independence, as required by the GDPR. This is the most common option for SMEs and mid-sized businesses.
What happens if I do not appoint a DPO when legally required?
If individual analysis concludes that the regulations require a DPO and the organisation fails to appoint one, fines of up to €10 million or 2% of global annual turnover may apply (art. 83.4 GDPR). In addition, the AEPD may require immediate appointment and publish the sanctioning resolution, causing significant reputational damage. This information is indicative; each case must be analysed individually.
Does your organisation need an external DPO?
At Certix you will be attended by a data protection expert, with no sales teams involved.