GDPR - Designation of the Data Protection Officer - Data Protection Officer

Recital - 97.
Data Protection Officer
Executive Summary
Name a Data Protection Officer and put their contact information on your Consent forms and website.
Recital Text
Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation. In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal data as ancillary activities. The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.
Executive Summary
Organizations will nominate a DPO, whether internally or contracted out, who is competent in both data security and data protection law, who will be involved in all issues related to the protection of personal data.

The DPO will report to the highest level of management, is bound to confidentiality concerning the performance of his tasks, and shall not be penalized for performing his duties. These duties should not have a conflict of interest and be performed in an independent manner.

The DPO should be available to the data subjects to exercise their rights. Their contact information should be available on consent forms and the Public Privacy Policy on the website.