The Three Mandatory DPO Appointment Scenarios Under GDPR Article 37
Article 37(1) of the GDPR sets out exactly three scenarios where appointing a Data Protection Officer is mandatory. These aren't suggestions , failure to appoint when required has drawn fines from supervisory authorities across the EU.
Scenario 1: Public authorities and bodies
Article 37(1)(a): "The processing is carried out by a public authority or body, except for courts acting in their judicial capacity."
This applies to any organization classified as a public authority under national law , government agencies, municipalities, public universities, and state-owned enterprises. The definition varies by member state. In Germany, public-law broadcasting institutions are covered. In France, the CNIL has clarified that organizations delivering public services under contract may also fall within scope.
If your organization receives public funding or delivers services on behalf of a public body, check whether your national DPA classifies this as "public authority" processing , the definition is broader than most expect.
Scenario 2: Large-scale, regular and systematic monitoring
Article 37(1)(b): "The core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale."
This is where most mid-market organizations get tripped up. "Core activities" doesn't mean HR or payroll processing . it means the processing that is central to achieving your business objectives. The WP29 guidelines (now endorsed by the EDPB) define key terms as follows:
- "Regular" means ongoing or occurring at particular intervals, not one-off. Customer loyalty tracking, network monitoring, and employee location tracking all qualify.
- "Systematic" means occurring according to a system, pre-arranged, organized or methodical. Behavioral advertising, credit scoring, and fraud detection systems are systematic by nature.
- "Large scale" considers the number of data subjects, volume of data, geographic extent, and duration of processing. There is no fixed numerical threshold , but a city-wide CCTV network or a telecom processing millions of customer records clearly qualifies.
For multi-entity organizations, this is where complexity multiplies. Your parent company may not independently trigger this threshold, but three subsidiaries combined might. And each subsidiary that does trigger it creates its own DPO obligation , unless you designate a group DPO under Article 37(2).
Scenario 3: Large-scale processing of special categories or criminal data
Article 37(1)(c): "The core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or of personal data relating to criminal convictions and offences referred to in Article 10."
Special category data includes health data, biometric data, racial or ethnic origin, political opinions, trade union membership, genetic data, and data concerning sex life or sexual orientation. If any of your subsidiaries processes this type of data as a core activity , a healthcare subsidiary, an insurance entity, a genetic testing unit , a DPO is mandatory for that entity.
The "large scale" qualifier applies here too. A single doctor's office processing patient records doesn't meet the threshold. A hospital network processing records across three countries does.
National Laws That Expand the GDPR Baseline
Article 37(4) explicitly allows member states to set additional requirements for DPO appointment. Several have done so , creating traps for organizations that only check the GDPR text.
- Germany (BDSG Section 38): A DPO is required when at least 20 employees are permanently engaged in automated processing of personal data. This is significantly lower than the GDPR's "large scale" threshold and catches many mid-market companies that wouldn't otherwise be covered.
- Austria: The Austrian Data Protection Act requires DPOs for processing that creates a high risk to individuals' rights , a broader standard than the GDPR's three scenarios.
- France: While the CNIL hasn't expanded mandatory appointment beyond GDPR Article 37, its guidance strongly recommends DPO appointment for any organization processing personal data as a significant part of its operations. In practice, French regulators expect a DPO or equivalent function.
- Romania, Greece, Slovakia: These member states have adopted additional sector-specific DPO requirements , particularly for financial services, telecommunications, and healthcare organizations.
For multi-entity organizations, this means a single group DPO assessment isn't enough. You need to check each subsidiary's obligation against the national law of the country where it's established , not just against the GDPR baseline.
Who Qualifies as a DPO? The Requirements Most Organizations Underestimate
Article 37(5) requires the DPO to be appointed "on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices." The EDPB has clarified this means:
- Legal and technical knowledge: The DPO must understand both the legal framework and the technical operations of the organization. A lawyer who doesn't understand IT infrastructure, or an IT manager who doesn't understand GDPR, won't meet the standard.
- Independence: Article 38(3) states the DPO "shall not receive any instructions regarding the exercise of those tasks." This means the DPO cannot be the CISO, the Head of Legal, or anyone whose role creates a conflict of interest. The EDPB has flagged CEO, COO, CFO, Head of HR, and Head of IT as inherently conflicted roles.
- Adequate resources: Article 38(2) requires the organization to provide "resources necessary to carry out those tasks and access to personal data and processing operations." A DPO appointment without budget, tooling, or access to processing records is a compliance failure waiting to happen.
- Accessibility: For group DPOs under Article 37(2), "easily accessible from each establishment" means accessible in terms of language, availability, and understanding of local regulatory requirements. A DPO in Zurich managing privacy for a Portuguese subsidiary needs either local language capability or a local privacy coordinator.
The Group DPO Model: How Multi-Entity Organizations Coordinate
Article 37(2) permits a group of undertakings to appoint a single DPO , provided they are "easily accessible from each establishment." In practice, this means building a coordination structure that gives the group DPO real visibility across every entity.
What "easily accessible" actually requires
- Data subjects in each jurisdiction must be able to contact the DPO in their local language , or at minimum, in a language they can reasonably be expected to understand
- The DPO must be able to communicate effectively with local supervisory authorities in each jurisdiction where the group operates
- The DPO must have operational visibility into the processing activities, vendors, incidents, and data subject requests of every entity they oversee
The operational reality without centralized tooling
Priverion's founder observed a 12-subsidiary enterprise managing GDPR compliance across 47 spreadsheets. The group DPO was spending the majority of their week chasing business units for ROPA updates, DPIA status reports, and vendor assessment completions , via email, shared drives, and monthly calls that were already outdated by the time they happened.
This is the norm, not the exception. Without a centralized platform that provides group-wide visibility, the group DPO model breaks down into exactly the kind of fragmented, undocumented compliance that supervisory authorities will challenge during an audit.
How Priverion supports the group DPO model
Priverion was built specifically for this architecture. A group DPO using Priverion gets:
- Cross-entity data mapping with centralized visibility into processing activities across every subsidiary
- Automated ROPA recertification . AXA achieved a 100% recertification rate with fully automated workflows, eliminating the manual chase
- DPIA and TIA automation with AI-assisted drafting and risk scoring, with all outputs reviewed by the DPO before they become compliance records
- Incident management workflows that route breach notifications to the right subsidiary and the right supervisory authority
- A DPO dashboard providing operational oversight of compliance status across the entire group
All data is processed within Swiss infrastructure, providing European data residency and Swiss data sovereignty , a meaningful legal advantage for organizations managing cross-border data transfers in a post-Schrems II environment.
Even If You Don't Need a DPO: Document Your Assessment
Article 37 doesn't require you to appoint a DPO in every situation , but every supervisory authority expects you to have assessed whether you need one. The absence of a documented assessment is itself a red flag during an investigation.
Your assessment should cover:
- Each entity within your group, evaluated against the three Article 37(1) scenarios
- National law requirements in each jurisdiction where you have an establishment
- Whether you are using the group DPO provision under Article 37(2), and how "easy accessibility" is ensured
- If you decide not to appoint, the rationale for that decision , documented and dated
This documentation should be reviewed annually, or whenever your group structure, processing activities, or regulatory environment changes.
