What it asks for. Controllers and processors must designate a data protection officer where processing is carried out by a public authority or body (except courts acting in their judicial capacity), where core activities involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large scale processing of special category or criminal offence data. Member state law may require it in other cases. A group can appoint a single DPO if easily accessible from each establishment.
In practice. Organisations document whether a DPO is required, appoint someone with expert knowledge of data protection law and practice, publish contact details and communicate them to the supervisory authority. Evidence includes the assessment, the appointment, published contact details and the notification to the authority.
Common gaps. The assessment of whether a DPO is needed is often not documented. Appointees may lack the required expertise or time.