Article 37 of the GDPR makes a data protection officer mandatory for some organizations and optional for the rest. Many SaaS companies are in the second group, and many are unsure which group they are in. Customer questionnaires that ask "Who is your DPO?" as though everyone has one do not help.
Getting it wrong costs you in both directions. Appoint a DPO you did not need and you take on Articles 38 and 39 in full, including independence and protection from dismissal. Fail to appoint one you did need and you are out of compliance from the day the obligation arose.
This article sets out the tests, the terms in them that carry the weight, who can hold the role, and what to record if you decide you do not need one.
The three tests in Article 37(1)
A controller or processor must designate a DPO in any case where:
The processing is carried out by a public authority or body, except for courts acting in their judicial capacity.
Its core activities consist of processing operations which, by their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale.
Its core activities consist of processing on a large scale of special categories of data under Article 9, or of personal data relating to criminal convictions and offenses under Article 10.
The tests apply to processors as well as controllers, and a processor assesses its own core activities. A SaaS provider whose service consists of processing health data at scale for its customers can meet test 3, even though the data sits within its customers' processing.
Article 37(4) also lets EU or Member State law require a DPO in other cases. Germany's federal data protection act is the best-known example, adding a trigger based on the number of people regularly involved in automated processing. Check national law in each member state where you are established.
What "core activities" means
The Article 29 Working Party's guidelines on DPOs, endorsed by the EDPB, describe core activities as the key operations necessary to achieve the controller's or processor's goals. They contrast these with ancillary functions every organization performs, such as paying employees or running standard IT support.
So payroll does not make you need a DPO, even though it involves personal data and is not occasional. Processing that is inextricably part of what you do can. The guidelines give the example of a hospital: its core activity is providing health care, and it cannot do that without processing health data.
For a SaaS company, a useful question is whether the product would still exist if this processing stopped. If it would not, the processing is probably a core activity.
What "large scale" means
The GDPR does not define large scale, and the guidelines decline to set a number. They ask you to consider:
the number of data subjects concerned, as a specific number or as a proportion of the relevant population,
the volume of data or the range of different data items processed,
the duration or permanence of the processing, and
the geographic extent of the processing.
They give examples on both sides. Processing of patient data in the regular course of business by a hospital is large scale, as is processing of customer data in the regular course of business by an insurance company or a bank. Processing of patient data by an individual physician is not.
What "regular and systematic monitoring" means
The guidelines read "monitoring" broadly. It includes all forms of tracking and profiling on the internet, including for behavioral advertising. "Regular" means ongoing, recurring at particular intervals, or constant. "Systematic" means occurring according to a system, prearranged, organized, or methodical.
Their examples include email retargeting, profiling and scoring for risk assessment such as credit scoring or fraud prevention, location tracking by mobile apps, loyalty programs, behavioral advertising, monitoring of fitness and health data through wearables, and connected devices such as smart meters.
For a SaaS company, the question is whether monitoring individuals is part of what you sell. Analytics on how people use your own product is more likely to be ancillary. A product whose purpose is to track, score, or profile individuals at scale may meet the test.
Who can be the DPO
Article 37(5) requires the DPO to be designated on the basis of professional qualities, in particular expert knowledge of data protection law and practices. Article 37(6) allows the DPO to be a staff member or to fulfill the tasks under a service contract. A group of companies may appoint a single DPO, provided the DPO is easily accessible from each establishment (Article 37(2)).
Article 38 sets the conditions of the role:
The DPO is involved properly and in a timely manner in all issues relating to the protection of personal data.
The organization provides the resources needed to carry out the tasks and to maintain expert knowledge.
The DPO receives no instructions regarding the exercise of those tasks.
The DPO is not dismissed or penalized for performing those tasks.
The DPO reports directly to the highest management level.
The DPO may hold other tasks and duties, provided they do not result in a conflict of interests.
Conflict of interests is where internal appointments go wrong. The guidelines say, as a rule, that conflicting positions may include senior management roles such as chief executive, chief operating officer, chief financial officer, head of marketing, head of human resources, or head of IT. Roles lower down can conflict too, if they determine the purposes and means of processing. The DPO would otherwise be reviewing their own decisions. The same reasoning applies to any role that decides how personal data is processed, which is why naming a security or legal leader as DPO needs a careful look at what they decide in their day job.
Article 39 lists the tasks: informing and advising, monitoring compliance, advising on DPIAs, cooperating with the supervisory authority, and acting as its contact point. Article 37(7) requires you to publish the DPO's contact details and communicate them to the supervisory authority.
A DPO is not an EU representative
Non-EU companies sometimes confuse the two. Article 27 requires a controller or processor that is not established in the EU, but is subject to the GDPR under Article 3(2), to designate a representative in the EU, subject to limited exceptions. The representative is a point of contact for authorities and individuals, and acts on your behalf. A DPO is an independent advisor and monitor.
They are different roles with different tests. The EDPB's guidelines on territorial scope consider the representative role incompatible with acting as the same organization's external DPO, because of the conflict between the two sets of duties.
Recording a decision not to appoint
If you conclude that you do not need a DPO, write the analysis down. The guidelines recommend documenting the internal analysis of whether a DPO is required, so you can show the relevant factors were considered. The accountability principle in Article 5(2) applies to this decision as much as to any other.
A short record covers:
The processing activities you considered, drawn from your record of processing.
For each, whether it is a core or ancillary activity, and why.
Whether any core activity involves regular and systematic monitoring, or special category or criminal conviction data.
Your view on large scale, against the four factors.
Any national law requirements in the member states where you are established.
The date, the decision-maker, and a trigger for review, such as a new product line or a new market.
When a questionnaire asks for your DPO, answer accurately. Give the DPO's contact details, or state that you have assessed the requirement and have not designated one, and give the contact point for privacy matters. Adding a DPO title to satisfy a questionnaire creates the obligations in the warning above.
Whether a particular activity is core, or large scale, is a judgment that turns on facts and national practice. Confirm your conclusion with counsel, and revisit it when your product changes.
How TrustLynce helps
TrustLynce's services include a dedicated advisor and vCISO support, which can help you plan how to staff the privacy function while you work through the DPO question. The data privacy workflows keep the record of processing that the analysis draws on, with a dated record of the decision.