DPO
A Data Protection Officer (DPO) is the person an organization designates to inform and advise on data protection, monitor compliance and act as the contact point for data subjects and the supervisory authority.Articles 37 to 39 of the GDPR make a DPO mandatory for public authorities, for organizations whose core activities involve regular and systematic monitoring of people on a large scale, and for those processing special categories of data or criminal data on a large scale. Large-scale online tracking and behavioral advertising are the textbook example of systematic monitoring, so ad-funded publishers and ad tech companies usually need one; a small business website with analytics does not, although it may appoint one voluntarily.
The DPO must be independent, report to the highest management level, have the resources to do the job and not be dismissed for doing it. The DPO's contact details must be published and communicated to the supervisory authority, which is why privacy policies and some cookie policies name a DPO or a privacy contact. Several other laws have equivalents: Brazil's LGPD requires an encarregado for every controller (the ANPD's first fine in 2023 cited the absence of one), Quebec's Law 25 a person in charge of the protection of personal information, South Africa's POPIA an information officer, and Türkiye's KVKK a contact person registered in VERBİS.
A DPO does not need to be a lawyer or an employee; an external DPO is allowed. The role is distinct from the data controller, which remains responsible. When writing a cookie policy, name the DPO or privacy contact and how to reach them.