The DPO ensures that the organization complies with data protection rules. In some cases, the appointment of a DPO is mandatory. “The DPO shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practice. The necessary level of expert knowledge should be determined according to the data processing operations carried out and the protection required for the personal data being processed. The function of the DPO can also be exercised on the basis of a service contract concluded with an individual or an organization outside the controller’s/processor’s organization… Individual skills and strengths can be combined so that several individuals, working in a team, may more efficiently serve their clients” Article 29 Data Protection Working Party.
