Which of the following describes a mandatory requirement for a group of undertakings that wants to appoint a single data protection officer?

Question

Options

• AThe group of undertakings must obtain approval from a supervisory authority.
• BThe group of undertakings must be comprised of organizations of similar sizes and functions.
• CThe data protection officer must be located in the country where the data controller has its main
• DThe data protection officer must be easily accessible from each establishment where the

• A
  4% (1)
• B
  4% (1)
• D
  91% (21)

Explanation

According to Article 37(2) of the GDPR, a group of undertakings may appoint a single data protection officer (DPO) provided that the DPO is easily accessible from each establishment. This means that the DPO should be able to communicate effectively with the data subjects and the supervisory authorities in the relevant languages and jurisdictions, and to perform the tasks referred to in Article 39 of the GDPR. The accessibility of the DPO does not necessarily depend on the physical location of the DPO, but rather on the availability of the DPO to the relevant stakeholders via various means of communication. Therefore, the DPO does not have to be located in the country where the data controller has its main establishment, nor does the group of undertakings have to obtain approval from a supervisory authority or be comprised of organizations of similar sizes and functions to appoint a single DPO.

No community discussion yet for this question.