GDPR Article 39 gives a data protection officer (DPO) five lettered tasks, (a)–(e): inform and advise; monitor compliance; advise on and monitor data protection impact assessments (DPIAs); cooperate with the supervisory authority; and act as its contact point. Paragraph 2 then tells the DPO to perform these tasks with due regard to the risk of the processing, considering its nature, scope, context and purposes. Contact with people whose data is processed comes from Article 38(4), not a sixth task in Article 39(1).
This distinction matters operationally. The DPO is an adviser and monitor with protected independence; the controller or processor remains responsible for complying with the GDPR. A useful DPO work plan therefore identifies advice to give, decisions to challenge, evidence to inspect and authority communications to manage. It does not turn the DPO into the person who approves every processing operation or personally carries every compliance liability. The EDPB’s small-business DPO guidance explains the separation between independent DPO work and organisational accountability.
First check whether the role is required
Article 37(1) requires a DPO where processing is carried out by a public authority or body, except courts acting judicially; where core activities consist of operations requiring regular and systematic monitoring of people on a large scale; or where core activities consist of large-scale processing of special-category data or data on criminal convictions and offences. Other Union or Member State law can require a DPO in additional cases under Article 37(4). A business does not become exempt merely because it is small, and it does not need a statutory DPO merely because it stores some employee data. Assess its core activities and applicable national rules.
An organisation may appoint a DPO voluntarily. If it uses the GDPR DPO title, the Article 37–39 position and task requirements still matter. A different privacy contact or adviser can be valuable where a formal DPO is not required, but should not be presented as the independent statutory officer unless the position meets those safeguards. Document the designation decision and reassess when activities change. The DPO designation guide works through that threshold separately from this article’s task list.
Article 37(5) calls for professional qualities, particularly expert knowledge of data protection law and practices and capacity to fulfil Article 39 tasks. Article 37(6) permits a staff member or a person under a service contract. Article 37(7) requires publishing the DPO’s contact details and communicating them to the supervisory authority. It does not impose a uniform EU-wide “within 30 days” appointment notification deadline. Check the relevant authority’s current notification method and any national rule.
Task (a): inform and advise
The DPO informs and advises the controller or processor and employees who carry out processing about duties under the GDPR and other Union or Member State data-protection provisions. Advice is more than forwarding legal updates. The DPO might explain to a product team which data they propose to collect, why an existing purpose may not cover a new use, or what question legal counsel must answer before launch. A processor’s DPO may advise on instructions from customers, security duties and assistance commitments. The advice should state its assumptions and who receives it.
A written note is useful when a decision is material or contested, but Article 39 does not prescribe a memo for every conversation. In a team with high staff turnover, a short recurring briefing on data handling may be better than one long annual lecture. Training is mentioned in task (b) as part of monitoring, and the DPO can contribute to it. The organisation decides the needed programme and resources. The employee GDPR training guide can help translate the advice into operational topics without implying a fixed EU-wide course cadence.
For example, a sales team asks whether it can import customer-support messages into a new prospecting tool. The DPO should identify the planned purpose, affected people, data categories, legal-basis and transparency questions, retention and access implications, and any processor or transfer issue. The business owner then decides whether and how to proceed in accordance with the law; the DPO’s advice is not a legal waiver. If management departs from material advice, recording the reasons and safeguards makes the decision reviewable.
Task (b): monitor compliance
Monitoring covers the GDPR, other applicable Union or Member State data-protection provisions, and the controller’s or processor’s own policies. Article 39(1)(b) expressly includes assignment of responsibilities, awareness raising, training of relevant staff and related audits. The DPO may sample records, interview owners, inspect how a privacy process works, review whether earlier findings were addressed, and report systemic gaps to management. “Monitor” does not mean the DPO must personally perform every audit or correct every defective record.
Start with an inventory of processing and the people accountable for it. Compare the written Article 30 record fields with actual systems and vendor relationships, then follow up discrepancies. The record itself is a duty of the controller or processor, subject to the statute’s exception. The DPO may help create or maintain it in practice if the organisation assigns that support and handles conflicts of interest, but the legal duty does not transfer to the DPO. The EDPB’s 2024 coordinated DPO enforcement report documents concerns about resources, independence and role clarity; it does not create a universal rule that a DPO may never touch a register.
Monitoring needs a feedback loop. Suppose an audit finds that new marketing tools are installed before a privacy review. The DPO can identify the pattern and advise procurement, IT and marketing to add an approval step; management assigns an owner and budget; the DPO later tests whether the step actually catches new tools. A spreadsheet of unresolved audit findings is less useful if no owner is required to respond. The DPO should be able to escalate persistent or serious findings to the highest management level under Article 38(3).
The DPO’s monitoring scope should include processors where appropriate, but Article 28 places the duty to use processors with sufficient guarantees on the controller. The DPO can review a sample contract or due-diligence file, identify gaps and recommend action. The contract owner or controller must negotiate, implement and track the required safeguards. The same distinction applies to breach logs: the DPO may monitor whether Article 33 decisions are documented, but the controller remains responsible for notifications.
Task ©: advise on and monitor DPIAs
Article 35(2) says the controller shall seek the DPO’s advice where a DPO has been designated when carrying out a DPIA. Article 39(1)© has the DPO give advice where requested and monitor the assessment’s performance. Those phrases matter: the controller owns the DPIA and its risk decision; a DPO is not a mandatory author or automatic sign-off authority. In a functioning workflow, the DPO should be involved early enough to assess the proposed operation and comment before decisions are locked in.
Useful DPO questions include whether the processing is likely to create high risk, whether the described purposes and data flows match the product, whether the necessity and proportionality analysis is specific, what mitigations are practical, and who is responsible for residual risk. The DPO can challenge an optimistic assumption about access, retention or affected people and later check whether the agreed controls were implemented. The DPIA guide covers the controller’s assessment in depth.
If the remaining high risk calls for prior consultation under Article 36, the controller must decide and consult before starting the relevant processing. The DPO’s Article 39(1)(e) authority-contact task helps carry the dialogue, but neither the DPO’s advice nor a submitted DPIA is automatic authorisation to start. The Article 36 prior-consultation guide explains that separate statutory path. Record the DPO’s comments and the controller’s response so later reviewers can see the reason for the chosen controls.
Task (d): cooperate with the authority
The DPO cooperates with the supervisory authority on issues relating to processing. That may mean understanding an authority’s request, assembling a reliable account from internal owners, explaining the organisation’s processing and making sure the appropriate decision-maker responds. It does not mean the DPO must be the sole speaker in every investigation, hold every source document, or independently guarantee that a controller’s records are accurate. Article 31 separately obliges controllers and processors, and where applicable their representatives, to cooperate with a supervisory authority on request.
For a significant complaint or inspection, agree beforehand who retrieves contracts, records, DPIAs and incident evidence, who checks accuracy, and who is authorised to make commitments. The DPO needs access under Article 38(2), but legal, security and business teams may hold the underlying facts. Treat a deadline from an authority as a case-specific requirement, not a generic Article 39 calendar. A clear internal handoff protects both the quality of the response and the DPO’s independence.
Task (d) also applies where the DPO has raised a concern internally. The officer should not be instructed to conceal a material problem or endorse a position they do not believe is supportable. Confidentiality under Article 38(5) and applicable national law still governs how information is handled. Record the authority contact and internal decisions without treating a DPO’s cooperation as a transfer of the controller’s statutory accountability.
Task (e): act as authority contact point
The DPO is a contact point for the supervisory authority on processing issues, including Article 36 prior consultation, and may consult it on other matters where appropriate. This is the fifth and final lettered task. It provides a reliable route for questions, but “contact point” is not the same as exclusive authority to bind the organisation. Ensure the published details reach the DPO or a covered deputy, and define an internal process for urgent requests during absence.
The DPO’s contact details must be published and communicated to the authority under Article 37(7). GDPR Articles 13(1)(b) and 14(1)(b) require DPO contact details in the relevant information given to people where applicable. Article 30(1)(a) and 30(2)(a) include DPO name/contact details where applicable in the respective controller and processor records. These provisions do not require posting a private home address or a particular person’s name in every public notice; a functioning contact channel may satisfy the published-contact requirement, subject to authority or national instructions.
People whose data is processed may contact the DPO under Article 38(4) about their data and rights. This is an important part of the position, but it is not a sixth Article 39(1) letter. The DPO can help route an access request, understand a complaint or identify the team holding records. The controller remains responsible for a lawful, timely answer. A privacy inbox that routes all requests to the DPO with no access to systems or support staff would make the contact promise ineffective.
Independence, resources and other duties
Article 38(1) requires the controller or processor to involve the DPO properly and in a timely manner in all personal-data protection issues. Article 38(2) requires resources, access to personal data and processing operations, and support for maintaining expertise. Article 38(3) bars instructions regarding performance of DPO tasks, protects against dismissal or penalty for performing those tasks, and requires direct reporting to the highest management level. These protections do not prevent ordinary employment management or make every DPO recommendation binding. They make candid advice and monitoring possible.
Article 38(6) allows other tasks and duties if they do not create a conflict of interests. The question is whether the additional role lets the same person determine purposes or essential means and then independently monitor that decision. Senior executive, HR or IT leadership may create such a conflict depending on actual decision powers; job titles alone are an incomplete test. A security officer could advise on controls without necessarily setting the organisation’s processing purposes, but dual appointment needs a documented conflict assessment. The DPO position guide helps examine reporting lines and conflicts in detail.
The DPO need not be a full-time employee: Article 37(6) permits a service contract. An external provider can bring expertise, but needs timely access, workable availability, confidentiality and a path to senior management. An internal DPO may know systems well but needs enough protected time and independence from operational decisions. There is no statutory salary band or retainer price; obtain a proposal based on processing complexity, number of entities, required presence, languages and response expectations. The DPO job-description template can help specify responsibilities without assigning the officer the controller’s accountability.
Apply Article 39(2) to a realistic work plan
The risk instruction in Article 39(2) asks the DPO to consider the nature, scope, context and purposes of processing while carrying out all five tasks. It does not prescribe a scoring grid, a fixed monthly audit cadence or an annual report format. A hospital DPO may give special attention to broad access to health records; an online platform DPO may focus on large-scale tracking or profiling; a small processor’s DPO may focus on customer instructions, privileged access and subcontracting. The reason for the priority should be explainable.
Build a work plan from the processing record, complaints, incidents, DPIAs, new-project pipeline and earlier findings. For each priority, identify the owner who can change the process, the DPO advice or monitoring step, the evidence to examine and the decision date. Leave room for unexpected issues: a significant breach or new high-risk project may outrank a planned routine review. Report material findings and resource constraints to senior management in a form they can act on. An annual summary can be useful, but Article 39 does not demand one universally.
For example, if several teams launch customer-facing AI features, the DPO might review the common data inputs and transparency approach, sample a high-risk use case, and advise on a DPIA where Article 35 applies. Product and legal owners remain responsible for the lawful design. If the DPO lacks access to the model’s data flows, the first finding should be that access gap, not an invented assurance that the feature is compliant. Risk-based work is credible when priorities and unresolved findings can be traced to evidence.
Oversight and consequences
Articles 37–39 sit within the obligations addressed by GDPR Article 83(4)(a), whose administrative-fine ceiling is the higher of €10 million or 2% of the undertaking’s worldwide annual turnover of the preceding financial year, where applicable. A ceiling is not the likely fine for a missing appointment or an inadequate work plan. The authority must establish an infringement and assess the Article 83(2) factors. The DPO is not automatically personally liable for the controller’s GDPR breach merely because they advised on it; separate employment, professional or national-law issues may arise on their own facts.
The GDPR Article 24 controller-responsibility guide explains why management must implement and demonstrate appropriate measures. A DPO can warn that a measure is weak, monitor whether it improves and cooperate with the authority; they cannot replace the controller’s decision or resources. The DPO software comparison is useful only after that division of work is clear. A task board or dashboard can show advice and follow-up, but it cannot confer statutory independence.
Questions about the DPO’s tasks
Are there six mandatory Article 39 tasks? No. Article 39(1) has five letters, (a) through (e). Paragraph 2 is the risk-based instruction for performing them. Article 38(4) separately lets people contact the DPO about processing and their rights.
Must the DPO maintain the ROPA? The controller or processor has the Article 30 record duty. The DPO may help maintain or monitor a record if assigned, but the organisation must preserve independent monitoring and avoid a conflict. Do not treat a DPO-maintained spreadsheet as a transfer of legal responsibility.
Can a DPO be external or hold another role? Yes. Article 37(6) permits a service contract and Article 38(6) permits other duties without a conflict of interests. Assess real decision authority, resources and access rather than assuming every dual title is allowed or forbidden.
Does a DPO approve DPIAs or prior consultation? The controller seeks advice where a DPO has been designated, and the DPO advises where requested and monitors the DPIA. The controller owns the assessment and any Article 36 consultation decision. An officer’s signature is not a statutory approval shield.
Who is accountable if a DPO’s advice is ignored? The controller or processor remains responsible for its obligations. Record the advice, the business decision and resulting safeguards. The DPO should be able to escalate material concerns to top management and must be free from instructions on how to perform the independent task.