Data Protection Officer

A data protection officer (DPO) is an expert appointed by an organization to oversee compliance with data protection law, particularly the GDPR. The DPO advises the organization on privacy obligations, monitors data processing activities, and acts as a contact point for data subjects and supervisory authorities. Under certain conditions, organizations must appoint a DPO by law.

Legal Basis

"The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10."

— Article 37(1), Regulation (EU) 2016/679 (GDPR)

Why It Matters

The DPO plays a critical role in ensuring that organizations handle personal data lawfully and transparently. For providers of political advertising services and online platforms, the DPO helps navigate complex requirements around targeting techniques, consent, and data subject rights under both the GDPR and the Regulation on Political Advertising (EU 2024/900).

Organizations that process large volumes of personal data—such as platforms using targeting or ad-delivery techniques for political advertising—typically must appoint a DPO. The DPO ensures compliance with data protection principles, advises on data protection impact assessments, and cooperates with supervisory authorities during investigations or audits.

For political actors and publishers using personal data for online political advertising, the DPO is a key resource for understanding when and how personal data may be processed, what legal bases apply, and how to respond to complaints from data subjects or authorities.

Key Points

Mandatory in certain cases: Public authorities, organizations conducting large-scale monitoring, and those processing special category data on a large scale must appoint a DPO
Expert role: The DPO must have expert knowledge of data protection law and practices, and be able to fulfill their tasks independently
Contact point: Acts as the primary contact for data subjects exercising their rights and for supervisory authorities investigating compliance
Advisory function: Advises the organization on GDPR compliance, data protection impact assessments, and best practices for privacy by design
Independence: The DPO cannot be dismissed or penalized for performing their duties and must report directly to senior management
Relevant for political advertising: Helps ensure compliance with GDPR rules on consent, special category data, and targeting when personal data is used in political advertising under Regulation 2024/900

Data Protection Officer vs. Compliance Officer

While both roles focus on regulatory compliance, they have distinct mandates. A data protection officer specializes exclusively in privacy and data protection law, particularly GDPR compliance. They monitor data processing, advise on legal bases for processing, and handle data subject requests and supervisory authority inquiries.

A compliance officer has a broader mandate, overseeing adherence to all applicable laws and internal policies—including anti-corruption, financial regulation, labor law, and sector-specific rules. In organizations subject to the Regulation on Political Advertising, a compliance officer may coordinate overall TTPA compliance (transparency notices, record-keeping, reporting channels), while the DPO focuses specifically on the lawfulness of personal data use in targeting and ad-delivery techniques.

Some organizations combine these roles, but the GDPR requires the DPO to act independently and with sufficient resources to fulfill data protection duties effectively.

Related Terms

Controller
Processor
Personal data
Special category data
Consent
Targeting techniques
Data protection impact assessment (DPIA)
Supervisory authority
Legal basis for processing
Data subject rights

Very transparent. Every political ad will be labelled, linked to a transparency notice with detailed information, and online ads will be searchable in a central European repository.

The Network coordinates election-related cooperation between member states. National contact points for TTPA enforcement should be members of this network where possible.

Election campaigns will need to ensure all paid advertising includes proper labels and transparency notices. Sponsors must be prepared to provide required information to all service providers.

Several major platforms currently do not allow paid political advertising, including some large social networks. This limits where political actors can place paid online advertisements.

The TTPA applies from 10 October 2025. Member States had until 10 April 2025 to designate competent authorities, and the Commission must provide label templates by 10 July 2025.

Publishers must ensure completeness and accuracy of certain information but are not required to verify all sponsor claims. They must correct manifestly erroneous information when they become aware of it.

Yes. When a hosting provider and a website both display an ad, both are considered publishers with responsibility for their specific services. Contracts should clarify how they share compliance duties.

If a publisher removes or disables access to a political ad due to illegality or terms violations, they must still provide access to the transparency information for the full seven-year retention period.