Agent WranglersScope and ownership Required
Decide whether you need a data protection officer
Record whether GDPR Article 37 requires a data protection officer, with the reason. If it does, publish the contact and tell the supervisory authority.
How to do it
Article 37 requires one for public bodies. It also does when your core work is large-scale, regular monitoring of people, or large-scale processing of special categories of data. A tracking or profiling product often meets the first test. Put the decision in the obligations register. If you appoint one, publish a role address, such as dpo@example.com, in the privacy policy.
How to check
The register has a DPO entry with a decision. When it says yes, a test fetches the privacy policy and finds the DPO address. The register also holds the date the authority was told.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/scope-and-ownership/dpo-decision.