Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 39
Tasks of the data protection officer
Chapter 4|Controller and Processor|📖 4 min read
1. The data protection officer shall have at least the following tasks:
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d) to cooperate with the supervisory authority;
(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.
Understanding This Article
Article 39 defines the DPO's core responsibilities. The DPO is an advisor, monitor, and liaison - not a decision-maker or compliance enforcer. Organizations remain responsible for compliance; the DPO helps achieve it.
Paragraph 1 - Five Core Tasks:
(a) Inform and Advise:
Educate controller/processor and employees about GDPR obligations
Provide guidance on compliance requirements
Advise on national data protection laws
Interpret regulations for organization's context
(b) Monitor Compliance:
Monitor adherence to GDPR and internal policies
Assign data protection responsibilities
Conduct awareness-raising and training programs
Perform or oversee audits
Track compliance status
(c) Advise on DPIAs:
Provide advice on DPIA requirements
Help conduct DPIAs
Monitor DPIA performance
Review risk assessments
(d) Cooperate with Supervisory Authority:
Respond to authority inquiries
Provide information and documentation
Facilitate inspections and audits
Maintain positive relationship
(e) Serve as Contact Point:
Primary point of contact for supervisory authority
Handle prior consultations (Article 36)
Consult on other data protection matters
Coordinate between organization and authority
Paragraph 2 - Risk-Based Approach:
DPO should focus efforts based on risk, considering:
Nature of processing
Scope (how much)
Context (circumstances)
Purposes (why)
High-risk processing deserves more attention.
Key Points
Five core tasks: inform/advise, monitor compliance, advise on DPIAs, cooperate with authority, serve as contact point
Must inform and train staff on data protection obligations
Monitors compliance including audits
Risk-based approach to tasks considering nature, scope, context, purposes
Not personally liable for non-compliance (organization is)
Advisory role - doesn't make final decisions
Practical Application
Task (a) - Inform and Advise Activities:
Conduct GDPR training sessions for staff
Prepare and distribute data protection guidelines
Advise on privacy notices
Review contracts for GDPR compliance
Answer employee questions about data protection
Provide guidance on specific processing activities
Advise on data subject rights requests
Issue internal newsletters on data protection topics
Task (b) - Monitor Compliance Activities:
Conduct regular compliance audits
Review processing activities and Article 30 records
Check privacy notices for accuracy
Monitor data subject request handling
Track training completion rates
Review data processing agreements
Assess new processing for compliance
Report compliance status to management
Maintain compliance dashboard
Task (c) - DPIA Activities:
Identify when DPIA required
Provide DPIA methodology and templates
Participate in DPIA workshops
Review completed DPIAs
Advise on risk mitigation measures
Determine if prior consultation needed (Article 36)
Maintain DPIA repository
Task (d) - Cooperate with Authority Activities:
Handle authority information requests
Coordinate responses to investigations
Prepare for inspections
Submit required documentation
Participate in authority meetings
Implement authority recommendations
Stay informed of authority guidance
Task (e) - Contact Point Activities:
Manage data subject inquiries and complaints
Handle breach notifications to authority
Conduct prior consultations (Article 36)
Respond to authority questions
Coordinate between organization and authority
Maintain communication logs
Typical DPO Work Week:
Monday: Review new processing activities, meeting with IT on new system
Tuesday: Conduct GDPR training session, respond to data subject requests
Wednesday: DPIA workshop for new project, update Article 30 records
Thursday: Compliance audit of marketing department, management reporting
Friday: Policy review, authority correspondence, team meetings
Risk-Based Prioritization Example:
High Priority (High Risk):
New health data processing system
AI-driven profiling project
International data transfer arrangements
Large-scale behavior monitoring
Medium Priority (Medium Risk):
Marketing campaigns
New vendor onboarding
Website analytics implementation
Lower Priority (Lower Risk):
Standard employee payroll
Routine customer invoicing
Basic contact management
What DPO Does NOT Do:
Make final business decisions (advises, doesn't decide)
Ensure compliance (monitors, reports, but organization is responsible)
Take personal liability (organization remains liable)
Handle all data subject requests (DPO oversees, others can execute)