Frequently Asked Questions

Designation is mandatory in the three cases of Article 37(1) GDPR — public authority or body; large-scale regular and systematic monitoring; large-scale processing of special categories or criminal data — and, in addition, for the broad list of entities in Article 34 LOPDGDD.

Among others: professional associations, educational centres and universities, electronic communications operators, credit institutions and insurers, investment firms, energy and gas distributors, controllers of credit-scoring files, healthcare centres, gambling operators and private-security firms.

Yes. Article 34.3 LOPDGDD requires the AEPD — or the competent regional authority — to be notified of DPO designations, appointments and removals within ten days, whether the designation is mandatory or voluntary. The AEPD maintains a public register of DPOs.

No. The AEPD-DPD Certification Scheme is voluntary and attests the DPO's professional qualification, through bodies accredited by ENAC. One may act as a DPO without certification, but it brings security and trust.

Yes. Article 37(6) GDPR allows the DPO to perform the role under a service contract, external to the organisation.

The Compliance Officer ensures the organisation's general compliance and may hold management duties; the DPO is a specific data protection figure, with statutory independence, that does not decide the purposes or means of processing. Combining both may create a conflict of interests.

No. Article 36.2 LOPDGDD reinforces the GDPR guarantee: the DPO may not be removed or penalised for performing its tasks, save in cases of fraud or gross negligence.

Article 37 LOPDGDD allows the data subject to address the DPO before claiming to the AEPD; the DPO communicates the decision within a maximum of two months.

Article 37(5) GDPR requires expert knowledge of data protection law and practice; Article 35 LOPDGDD specifies that the qualification may be evidenced, among other means, by certification schemes such as the AEPD's.

It is the assessment the controller must carry out, prior to processing, where it is likely to result in a high risk to rights and freedoms, under Article 35 GDPR.

To the AEPD without undue delay and, where feasible, within 72 hours (Art. 33); where it entails a high risk, it must also be communicated to data subjects (Art. 34).

Information, access, rectification, erasure, restriction, portability, objection and not being subject to automated decisions, under Chapter III GDPR, alongside the digital rights of Title X LOPDGDD.

Yes. Besides the AEPD, there are regional authorities: the APDCAT in Catalonia, the AVPD in the Basque Country and the Council for Transparency and Data Protection of Andalusia.

Yes. Article 37(2) GDPR allows it, provided the DPO is easily accessible from each establishment.