Appointment of a Data Protection Officer: What other tasks can be assigned to them?

A Data Protection Officer may take on additional tasks, provided that this does not result in a conflict of interest with his or her statutory control and monitoring duties (see Art. 38 para. 6 GDPR).  

An advisory role is generally unproblematic, for example in the following areas:  

• Information and awareness raising,  
• Documentation of processing activities,  
• Risk assessments (e.g., data protection impact assessments),  
• Contract processing and joint responsibility,  
• Consent management, deletion concepts, and data subject rights.  

In practice, a Data Protection Officer is also often tasked with conducting training and audits.  

However, fundamental decisions on data protection strategy—such as the introduction or amendment of guidelines—should be reserved for the organisation’s management in order to maintain the independence of the Data Protection Officer.  

Note: This information does not constitute individual legal advice.