[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F39":3},{"item":4,"lessons":16,"controls":34,"related":48},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","39","Article 39","Tasks of the data protection officer",4,"General Data Protection Regulation","**What it asks for.** The data protection officer must inform and advise the controller or processor and its staff on their data protection obligations, monitor compliance with the GDPR and internal policies, advise on data protection impact assessments, and cooperate with and act as the contact point for the supervisory authority.\n\n**In practice.** A working DPO has a written mandate, direct access to senior management and enough time and budget to do the job. They run a monitoring plan covering assignment of responsibilities, awareness and training, and internal audits, and they review high-risk projects before launch. Evidence includes DPO reports to the board, advice logs showing where advice was followed or overruled and why, DPIA opinions, training records and correspondence with the authority. The DPO should prioritise by risk, as the article requires them to have due regard to the risk of processing.\n\n**Common gaps.** The DPO is often a part-time role combined with a conflicting job such as head of IT or legal counsel defending the business, is consulted too late, or has no record showing what advice was given and how management responded.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_39","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30],{"slug":19,"title":20,"published_at":21},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-failure-to-notify-uodo","Polish Bailiff Fined for DPO Conflict of Interest and Failure to Notify UODO","2026-10-07T14:21:43.313+00:00",{"slug":23,"title":24,"published_at":25},"polish-bailiff-fined-for-dpo-conflict-of-interest-and-missing-contact-details","Polish Bailiff Fined for DPO Conflict of Interest and Missing Contact Details","2026-10-06T14:21:09.166+00:00",{"slug":27,"title":28,"published_at":29},"click-rates-alone-dont-measure-phishing-risk-heres-what-does","Click Rates Alone Don't Measure Phishing Risk — Here's What Does","2026-09-11T18:20:44.184+00:00",{"slug":31,"title":32,"published_at":33},"kfc-spain-fined-25000-for-gdpr-violations-over-inadequate-privacy-notices-and-missing-dpo","KFC Spain Fined €25,000 for GDPR Violations Over Inadequate Privacy Notices and Missing DPO","2026-07-31T16:21:31.911+00:00",[35,40,44],{"slug":36,"name":37,"problem":38,"stories":39},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":41,"name":42,"problem":43,"stories":39},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":45,"name":46,"problem":47,"stories":39},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[49,54,59,63,68,73,77,81],{"family":5,"item":50,"code":51,"title":52,"together":53},"37","Article 37","Designation of the data protection officer",3,{"family":55,"item":56,"code":57,"title":58,"together":53},"cis","14","Control 14","Security Awareness and Skills Training",{"family":5,"item":60,"code":61,"title":62,"together":53},"38","Article 38","Position of the data protection officer",{"family":64,"item":65,"code":66,"title":66,"together":67},"itil","overview","ITIL",2,{"family":69,"item":70,"code":71,"title":72,"together":67},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":74,"item":65,"code":75,"title":76,"together":67},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":55,"item":78,"code":79,"title":80,"together":39},"8","Control 8","Audit Log Management",{"family":5,"item":56,"code":82,"title":83,"together":39},"Article 14","Information to be provided where personal data have not been obtained from the data subject"]