1Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation. 2In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal data as ancillary activities. 3The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. 4Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.
Title is an unofficial description, added for readability.
Who needs a DPO, in short
Not everyone. GDPR Recital 97 says a data protection officer (DPO) is needed in three situations: public authorities, organisations whose core business involves large-scale regular and systematic monitoring, and organisations whose core business involves large-scale processing of sensitive or criminal offence data. Whoever holds the role needs expertise that fits the processing and must be able to work independently.
What Recital 97 adds to Article 37
The binding designation rules are in Article 37, the DPO’s position in Article 38, and the tasks in Article 39. Recital 97 explains the intent behind them, and it contains the only definition of “core activities” anywhere in the Regulation.
| Topic | Recital 97 | Articles 37–38 |
|---|---|---|
| Core activities | Defined: an organisation’s primary activities, not processing that is ancillary to them | Term used in Art. 37(1)(b) and (c) but not defined |
| Public sector exemption | Courts or independent judicial authorities acting in their judicial capacity | Art. 37(1)(a): courts acting in their judicial capacity |
| Monitoring trigger | Framed around a private-sector controller | Art. 37(1)(b) applies to the controller or the processor |
| Expertise | Level depends on the processing carried out and the protection the data requires | Art. 37(5): professional qualities, expert knowledge of data protection law and practices, and ability to perform the Art. 39 tasks |
| Independence | Applies whether or not the DPO is an employee | Art. 37(6) allows staff or service-contract DPOs; Art. 38(3) bars instructions and dismissal for performing tasks; Art. 38(6) bars conflicts of interest |
Compared against the official text of Regulation (EU) 2016/679 on EUR-Lex. Where the recital and an Article differ, the Article is the binding rule.
“Core” is about the business, not the volume of data
Every organisation pays staff and runs IT, and those activities involve personal data. The Article 29 Working Party, in guidance later endorsed by the EDPB, treats them as ancillary. Its example is a hospital: providing health care is the core activity, and because that can’t be done without patient records, processing health data is core too, so hospitals must designate a DPO (WP243 rev.01). To judge “large scale”, the same guidelines look at the number of people affected, the volume and range of data, how long the processing lasts, and its geographic reach. Recital 91 uses similar reasoning for impact assessments and excludes an individual physician’s or lawyer’s processing from “large scale”.
What this means in practice
- Write down which of the three triggers you considered and why each does or doesn’t apply. WP243 recommends documenting this analysis unless the answer is obvious.
- A voluntary DPO is encouraged, but the WP29 notes that the same Art. 37–39 rules then apply to that person.
- Groups can share one DPO if they are easily accessible from each establishment (Art. 37(2)).
- Check the DPO doesn’t also decide the purposes or means of processing in another role (CJEU, C-453/21).
- Confirm a direct reporting line to the highest management level (Art. 38(3)).
- Give the DPO time and resources to keep their knowledge current (Art. 38(2)). The EDPB’s 2024 review found insufficient resources and expert knowledge were common problems.
Enforcement cases
Each case maps to one sentence of Recital 97. Amounts and facts come from the decision or the authority’s own publication where one is available, and each case has its own write-up.
| Case | Authority / court | Date | Outcome | Recital 97 issue |
|---|---|---|---|---|
| Glovo (AEPD, PS/00417/2019) | AEPD (Spain) | Apr 2020 | €25.000 fine; reconsideration dismissed | Sentence 1: who must appoint |
| Proximus (APD, Decision 18/2020) | APD (Belgium) | Apr 2020 | €50.000 fine | Sentence 4: independence |
| Berlin e-commerce group (BlnBDI) | BlnBDI (Germany) | Sep 2022 | €525.000 fine | Sentence 4: independence |
| X-FAB Dresden (C-453/21) | CJEU | Feb 2023 | Preliminary ruling; no fine | Sentence 4: independence |
All Recital 97 enforcement cases
The regulators’ own view: problems are widespread
In 2023, 25 authorities across the EEA ran a coordinated investigation into DPOs and analysed more than 17,000 responses. The EDPB’s January 2024 report found organisations failing to designate a DPO even where it was mandatory, DPOs lacking resources or expert knowledge, and DPOs not being given the full set of tasks the law requires. It encourages organisations to give DPOs time and resources to keep their knowledge current, which is the point of Recital 97’s third sentence.
Frequently asked questions
Is GDPR Recital 97 legally binding?
Not on its own. Recitals explain the purpose behind the Articles and are used to interpret them. The binding DPO rules sit in Articles 37 to 39. Courts still rely on Recital 97: the CJEU quoted it in its 2023 X-FAB judgment on DPO conflicts of interest.
Does every company need a data protection officer?
No. A DPO is mandatory for public authorities and bodies (except courts acting in their judicial capacity), and for organisations whose core activities involve large-scale regular and systematic monitoring, or large-scale processing of special category or criminal offence data. Member State law can add further cases.
What counts as a core activity under Recital 97?
A core activity is part of the organisation’s primary business, not a support function. The Article 29 Working Party gives the example of a hospital: processing patient health records is core, while paying staff or running standard IT support is ancillary.
Can an employee be the DPO?
Yes. Recital 97 says a DPO can be an employee or an external appointee, and Article 37(6) allows a service contract. Either way, the DPO must be able to work independently and must not hold a role that decides the purposes and means of processing.
Can our head of IT, compliance or a managing director act as DPO?
Usually not. The CJEU held in C-453/21 that a conflict of interest arises where other duties lead the DPO to determine the purposes and means of processing. Regulators have fined a DPO who also directed audit, risk and compliance (Belgium, €50.000) and one who managed the group’s processor companies (Berlin, €525.000).
Applying this to your organisation, not just reading about it?
Whether a DPO is mandatory, who can hold the role, and how to keep it independent all depend on your structure. A DPO can work through the specifics with you.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 97 and Articles 37–39: official consolidated text
- Article 29 Working Party, Guidelines on Data Protection Officers (WP243 rev.01, revised 5 April 2017), endorsed by the EDPB: core activities, large scale, conflicts of interest
- CJEU, Case C-453/21 X-FAB Dresden GmbH & Co. KG v FC, judgment of 9 February 2023
- EDPB, report on the 2023 Coordinated Enforcement Action on the designation and position of DPOs, 17 January 2024
- Berliner Beauftragte für Datenschutz und Informationsfreiheit, press release on the €525.000 fine, 20 September 2022