Skip to content
Privacy and security

Data Protection Officer (DPO)

In a nutshell

The person who advises on and monitors GDPR compliance in an organisation; mandatory in certain cases.

The Data Protection Officer (DPO, GDPR Articles 37-39) informs and advises the organisation, monitors compliance, cooperates with the supervisory authority and is the contact point for people whose data is processed.

It is mandatory for public authorities and bodies, and for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of sensitive data. National laws can add cases (in Spain, Article 34 of the LOPDGDD lists further entities).

The DPO must act independently and have expert knowledge. In AI projects that process personal data, involving them from the start prevents many problems, especially in the impact assessment.

Reference: Arts. 37-39 RGPD; art. 34 LOPDGDD

Related terms

DPIA (Data Protection Impact Assessment)Record of Processing Activities (RoPA)AI OfficerAEPD (Spanish Data Protection Agency)
What applies to you?

Take the free assessment and find out in a few minutes which obligations your company has and where to start.

Take the free assessment

← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.