Data Protection Officer (DPO)

A data protection officer (DPO) is the officer provided for in Articles 37 to 39 of the GDPR who independently monitors a company’s compliance with data protection law.

Who Must Appoint One under the GDPR?

Under the GDPR, appointing a data protection officer is mandatory where:

• Processing is carried out by a public authority,
• The company’s core activities require regular and systematic monitoring of individuals on a large scale, for example behavioural advertising or location tracking,
• The company’s core activities consist of large-scale processing of special categories of data or data relating to criminal convictions.

Outside these cases, appointment is not mandatory, but designating someone responsible for monitoring compliance is recommended.

Tasks and Independence

The data protection officer informs the company and its employees about their obligations, monitors compliance, advises on data protection impact assessments, cooperates with the supervisory authority and acts as a contact point for individuals. The GDPR guarantees that the officer performs their tasks independently, cannot be dismissed or penalised for performing them, and reports directly to the highest level of management. The officer may be an employee or engaged externally.

The Position under the KVKK

There is no requirement to appoint a data protection officer under the KVKK. The data controller contact person notified by companies registered with VERBİS is a different concept: merely a point of contact, without the independence safeguards and monitoring role of a data protection officer.

Even so, designating someone to regularly monitor KVKK compliance, coordinate data subject applications and data breaches, and report to management is good practice, especially for medium and large companies. In companies also subject to the GDPR, this role can be combined with the GDPR data protection officer where needed.