Can a DPO be external?

Under Article 37(1) of the GDPR, a controller or processor must designate a DPO if it is a public authority or body, if its core activities involve regular and systematic monitoring of people on a large scale, or if its core activities involve large-scale processing of special categories of data or data on criminal convictions. Others may appoint one voluntarily. A group can appoint a single DPO if each establishment can easily reach them.

• Expert knowledge of data protection law and practice (Article 37(5)).
• Independence: no instructions on how to carry out the tasks, and no dismissal or penalty for performing them (Article 38(3)).
• Direct reporting to the highest management level.
• Involvement in all data protection issues in good time, with the resources needed (Article 38(1) and (2)).
• Published contact details, communicated to the supervisory authority (Article 37(7)).

The contract should state the tasks, the time available, how the DPO reaches management and how confidentiality is kept.

Article 38(6) allows a DPO to hold other tasks only if they do not create a conflict of interests. A role that decides on the purposes or means of processing personal data cannot also check that processing. Supervisory authorities have listed heads of IT among roles that usually conflict, and the Court of Justice confirmed in case C-453/21 (X-FAB) that the question is decided case by case. Many organisations keep the two roles separate for that reason.

Private companies in Switzerland are not required to appoint a data protection advisor (Article 10 FADP), and the advisor can be an employee or an outside person. If the advisor works independently, has no incompatible tasks and has the necessary expertise, and the company publishes their contact details and reports them to the FDPIC, the company can consult the advisor instead of the FDPIC after a DPIA that shows a high risk (Article 23).

With DPO as a service, Swiss experts run the register of processing activities, DPIAs, data subject requests and breach response with your team, inside Data Privacy in Acuna GRC. One processing activity can carry a legal basis for the GDPR and the FADP. Your people keep the decisions. See DPO as a service.