Regulation and data
Data protection officer (DPO)
The data protection officer (DPO) is the person, on the staff or engaged from outside, who informs and advises the controller and the processor, monitors their compliance and deals with the supervisory authority and with data subjects. Arts. 37 to 39 of the GDPR and 34 to 37 of Spain's LOPDGDD govern the role.
Also known asDPO · delegado de protección de datos · DPD
When it is mandatory and what it does
The GDPR requires one in three cases (art. 37.1): when processing is carried out by a public authority or body; when the core activity is regular and systematic monitoring of people on a large scale; or when it is large-scale processing of special categories, such as health data. Spain's LOPDGDD adds entities that always need one (art. 34.1), among them teaching centres at any level of education and public and private universities. A group may appoint a single one if they are easily reachable from each establishment (art. 37.2).
- Informs and advises the controller and its staff, including on the impact assessment (art. 39.1).
- Monitors compliance, the training of those who process data, and audits.
- Is the door for data subjects and the AEPD: a resident may contact them (art. 38.4), and the Agency may pass them a complaint to answer within one month (art. 37.2 of the LOPDGDD).
- Takes no instructions on how to perform their tasks, reports to the highest level of management and cannot be dismissed or penalised for performing them (art. 38.3).
- Is notified to the AEPD within ten days (art. 34.3 of the LOPDGDD), and their contact details are published (art. 37.7).
Worth knowing
Appointing one does not shift responsibility, which stays with the controller (art. 24). Whether a colegio mayor (a Spanish hall of residence with a formative programme) or a student residence falls within the art. 34 list has no single answer: it depends on its legal form and its relationship with the university —integrated, affiliated or independent—, and is best settled with the centre's adviser, as the guide to the GDPR in student residences says. An entity that is not obliged may appoint one voluntarily, under the same regime (art. 34.2).
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- Data protection impact assessment (DPIA)A data protection impact assessment (DPIA) is the analysis a controller carries out before starting processing that is likely to pose a high risk to people's rights: it describes the processing, assesses its necessity and its risks, and sets the measures to reduce them (art. 35 of the GDPR).