Data Protection Officer under GDPR – when is a DPO required and how is one appointed? 2026 Guide

Source check: 2 November 2026 · GDPR and Swedish authority guidance · Editorial review, not a specific legal review.

An organisation must appoint a data protection officer (DPO) in the cases specified in Article 37 GDPR. The requirement applies to authorities and public bodies (with one exception for the judicial activities of courts) as well as certain activities involving large-scale systematic monitoring or large-scale processing of special categories of personal data or criminal convictions and offences as core activities. The DPO must be able to work independently and serve as a contact point for data subjects and the supervisory authority.

When is a data protection officer mandatory?

Article 37.1 of the General Data Protection Regulation (EU) 2016/679 specifies three main situations. For private companies, it is particularly important to distinguish normal personnel administration from large-scale processing that constitutes the core activity.

There is no general rule that every limited company, employer, or organisation with a customer register must appoint a DPO. See IMY's guidance on when a DPO is required.

What does a data protection officer do under Article 39?

The data protection officer shall inform and advise on the rules, monitor compliance, advise on data protection impact assessments, and cooperate with IMY. The DPO must work on a risk-based approach. The DPO does not assume the organisation's responsibility for GDPR. It is the data controller and, where applicable, the data processor that must fulfil their obligations.

• Advise on the implementation of new systems that process personal data.
• Monitor training, allocation of responsibilities, and internal data protection controls.
• Advise on a DPIA without having to make decisions for the organisation themselves.
• Serve as a contact point for data subjects and IMY.
• Report risks and observations to senior management.

Further reading: data protection impact assessment under GDPR and records of processing under Article 30.

Independence, resources and conflicts of interest

Article 38 requires that the data protection officer be involved in a timely manner, receive the necessary resources, and not receive instructions on how to perform their statutory duties. The DPO must report directly to the highest management level. Other duties are permitted only if they do not create conflicts of interest.

Example: A manager who personally decides on the purposes and means of large-scale processing of personal data may be unsuitable as a DPO for the same organisation. An assessment of the actual role is required, not just the title. See IMY's comments on Articles 37–39.

How to document the appointment – six steps

1. Needs assessment: document whether Article 37.1 applies and which processing activities underlie the conclusion.
2. Competence: check knowledge of data protection, the organisation's systems, and risks.
3. Independence: map out other roles and any conflicts of interest.
4. Decision: document the mandate, organisational placement, reporting line, and resources.
5. Contact details: publish the contact route and notify IMY in accordance with Article 37.7.
6. Follow-up: document training, reviews, and changes to the mandate.

Practical examples and common mistakes

Small businesses with payroll and customer administration

Ordinary personnel and customer administration alone does not automatically require a DPO. The company must still comply with other applicable GDPR rules. Document the needs assessment and review it if the organisation changes.

Activities involving large-scale monitoring

If the core activity involves regular and systematic monitoring of individuals on a large scale, Article 37.1(b) may apply. Assess, among other things, the nature, scope, and purposes of the processing.

Common mistakes: appointing a person without assessing conflicts of interest, not giving the DPO time and resources, forgetting to notify IMY, or believing that the DPO is solely responsible for ensuring that the organisation complies with GDPR.

Frequently asked questions

Must small businesses appoint a data protection officer?

Not solely because of their size. Assess the specific criteria in Article 37.

Can the data protection officer be an external consultant?

Yes. Article 37.6 allows both employees and external contractors, provided that the requirements are met.

Can a group of companies have a joint data protection officer?

Yes, if the DPO is easily accessible from every establishment. Resources and any conflicts of interest must also be assessed.

Is the DPO responsible for all personal data breaches?

The DPO provides advice and may be involved in incident management, but the organisation's own obligations remain. Read the guide on personal data breaches.

Document templates and related guidance

Also read the difference between a data controller and a data processor.

Legal sources and scope

• GDPR (EU) 2016/679, Articles 37–39, Swedish full text.
• IMY – Must we appoint a data protection officer?.
• IMY – About the data protection officer in the General Data Protection Regulation.
• IMY – Notify a data protection officer.

Source check performed 2 November 2026 against the specified official sources. No specific legal review of the article is documented. General information about GDPR and Swedish supervisory practice, not individual legal advice.