{"id":1491,"date":"2022-07-27T09:43:03","date_gmt":"2022-07-27T07:43:03","guid":{"rendered":"https:\/\/mikinski.bg\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/"},"modified":"2023-04-28T00:35:43","modified_gmt":"2023-04-27T22:35:43","slug":"how-to-determine-whether-we-need-a-data-protection-officer-dpo","status":"publish","type":"post","link":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/","title":{"rendered":"How to determine whether we need a data protection officer (DPO)?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"1491\" class=\"elementor elementor-1491 elementor-1234\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d30e9a0 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d30e9a0\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1b359a1\" data-id=\"1b359a1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-4118b31 elementor-widget elementor-widget-text-editor\" data-id=\"4118b31\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\tIn order to answer this question, the provisions of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter referred to in this Article as General Data Protection Regulation(s) and \/ or <strong>GDPR<\/strong>) should be examined.\r\n\r\nArticle 37 of the GDPR lists the organizations that are obliged, within the meaning of the Regulation, to appoint DPOs. The cases in which the appointment of a DPO is mandatory will be considered below. Even if an organization is not obliged to appoint a DPO, the appointment of such person can only have a positive effect on the protection of the personal data processed and, accordingly, prevent possible sanctions by the control authorities.\r\n\r\n<strong>I.\u00a0<u>WHICH ORGANIZATIONS ARE OBLIGATED TO APPOINT DPO?<\/u><\/strong>\r\n\r\nThis section lists all the cases in which a company will be obliged to appoint a DPO. The obligation will be present even if the organization falls into only one of the categories described below.\r\n\r\n<strong>1.1. ORGANIZATIONS WHOSE CORE ACTIVITY REQUIRES REGULAR AND SYSTEMATIC LARGE-SCALE MONITORING<\/strong>\r\n<ul>\r\n \t<li><strong>What does \u201ccore activity\u201d mean?<\/strong><\/li>\r\n<\/ul>\r\nThe core activity is the one that helps to achieve the goals of the organization.\r\n\r\nFor example, the main purpose of a company for private security activities is to conclude and perform contracts for security of various sites. To carry out this activity, the organization hires staff. The processing of personal data of the staff for the purposes of the employment relationship between the persons and the company is an ancillary process and not the core activity or the main direction of economic activity.\r\n\r\nOn the other hand, the monitoring of commercial sites is undoubtedly part of the core activity of the company. During its implementation, personal data (biometric and other data) of individuals is inevitably processed, due to which the Company will have an obligation to appoint a DPO.\r\n<ul>\r\n \t<li><strong>What does \u201cregular and systematic monitoring\u201d mean?<\/strong><\/li>\r\n<\/ul>\r\nAccording to the accepted interpretation, \u201cregular and systematic\u201d means the non-accidental processing of personal data, which is part of the core activity of the organization. It happens on an ongoing basis or at certain intervals and through its implementation the set economic goals are directly achieved.\r\n\r\nFor example, if an organization has hired a company to take care of the video surveillance of the organization\u2019s sites to protect its property, and the organization requests to review the records from a specific point in time to determine a violation, this monitoring will not be considered as \u201cregular monitoring\u201d for the organization. Thus it will not require the appointment of a DPO. However, the company that is hired to carry out the monitoring, performs this activity on a daily basis and to achieve an economic result. Therefore, there is an obligation for this company to appoint a DPO.\r\n\r\nAnother example of an activity that represents \u201cregular and systematic monitoring of individuals\u201d is the profiling and assessment of individuals by an insurance company for the purpose of performing risk assessment and calculating insurance premiums. This processing is performed at the conclusion of each insurance policy and is part of the core activity of the insurance company. The organization will therefore be obliged to appoint a DPO on this basis.\r\n<ul>\r\n \t<li><strong>What does \u201clarge-scale\u201d mean?<\/strong><\/li>\r\n<\/ul>\r\nThe applicable legislation does not provide specific measures of when personal data is processed in \u201clarge-scale\u201d. The assessment of this should be made independently by the organization in each case of processing based on the following factors:\r\n<div class=\"wp-block-stackable-icon-list stk-block-icon-list stk-block stk-501bcba\" data-block-id=\"501bcba\">\r\n<ul>\r\n \t<li>Number of individuals whose personal data is processed;<\/li>\r\n \t<li>Volume of the personal data processed;<\/li>\r\n \t<li>Duration of personal data processing;<\/li>\r\n \t<li>Geographical scope of the processing activity.<\/li>\r\n<\/ul>\r\n<\/div>\r\nCases in which the processing of personal data is considered large-scale are<a id=\"_ftnref1\" href=\"https:\/\/oldmikinski.mycompany.bg\/en\/2022\/02\/15\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#_ftn1\"><sup>[1]<\/sup><\/a>:\r\n<div class=\"wp-block-stackable-icon-list stk-block-icon-list stk-block stk-efc866b\" data-block-id=\"efc866b\">\r\n<ul>\r\n \t<li>processing of patients\u2019 personal data in the usual conditions of carrying out the activity of \u0430 hospital;<\/li>\r\n \t<li>processing of personal data of individuals using city\u2019s public transport system (e.g. travel card tracking);<\/li>\r\n \t<li>processing of customers\u2019 personal data by an insurance company or a bank in the usual conditions of carrying out the activity;<\/li>\r\n \t<li>processing of personal data by a search engine for the purpose of behavioral advertising;<\/li>\r\n \t<li>data processing (content, traffic, location) by telephone or internet service providers.<\/li>\r\n<\/ul>\r\n<\/div>\r\nAnd here are some cases in which there isn\u2019t large-scale processing:\r\n<div class=\"wp-block-stackable-icon-list stk-block-icon-list stk-block stk-b48b6f9\" data-block-id=\"b48b6f9\">\r\n<ul>\r\n \t<li>processing of patients\u2019 personal data by an individual doctor;<\/li>\r\n \t<li>processing of personal data by an individual lawyer in connection with convictions and violations.<\/li>\r\n<\/ul>\r\n<\/div>\r\n<strong>1.2. ORGANIZATIONS WHICH PERFORM LARGE-SCALE PROSSESING OF SPECIAL CATEGORIES OF PERSONAL DATA AND PERSONAL DATA RELATED TO CRIMINAL CONVICTIONS AND OFFENCES<\/strong>\r\n<ul>\r\n \t<li><strong>Which categories of personal data are special?<\/strong><\/li>\r\n<\/ul>\r\n<div class=\"wp-block-stackable-icon-list stk-block-icon-list stk-block stk-cd97147\" data-block-id=\"cd97147\">\r\n<ul>\r\n \t<li>data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership;<\/li>\r\n \t<li>genetic data \u2013 such data is related to inherited or acquired genetic traits, giving unique information about the characteristics or health of the individual, which are obtained, in particular, from the analysis of a biological sample by the individual in question;<\/li>\r\n \t<li>biometric data \u2013 this is data obtained as a result of specific technical processing, which is related to the physical, physiological or behavioral characteristics of an individual and allows his unique identification, such as facial image;<\/li>\r\n \t<li>health data;<\/li>\r\n \t<li>personal data on the sexual life or sexual orientation of the individual.<\/li>\r\n<\/ul>\r\n<\/div>\r\nIt should be emphasized that the obligation to appoint a DPO arises both when simultaneous large-scale processing of special categories of personal data and personal data related to criminal convictions and offences is being executed, and when large-scale processing of only one of these two categories of personal data is executed.\r\n\r\n<strong>1.3. PROCESSING OF PERSONAL DATA BY A PUBLIC AUTHORITY OR STRUCTURE<\/strong>\r\n\r\nThe GDPR does not define the term \u201cpublic authority or structure\u201d and should therefore be defined in accordance with the national law. Within the meaning of \u00a7 1, item 17 of the Additional Provisions of the Personal Data Protection Act, a \u201cpublic body\u201d is a state or local body, as well as a structure whose main activity is related to the spending of public funds.\r\n\r\nIn the Republic of Bulgaria such are:\r\n<ul>\r\n \t<li><strong>State bodies:\u00a0<\/strong>all structures that exercise public power and have powers explicitly regulated by law or other normative act. No matter in what field their activity is carried out, if it is necessary to perform actions for personal data processing, they must appoint a data protection officer;<\/li>\r\n \t<li><strong>The bodies of the local self-government:\u00a0<\/strong>the municipal council, the mayor of the municipality and the regional governor. The municipal council is a body of local self-government in the municipality, the mayor is a body of executive power in the municipality, and the district governor exercises governance in the district and in this sense he acts as a local representative of the central government.,<\/li>\r\n \t<li><strong>Other public entities established by virtue of a normative act for performing public functions:\u00a0<\/strong>a public entity is an entity that is designed to meet needs of public interest, which are not industrial or commercial in nature and which is funded by more than 50 percent of state, territorial or local authorities or other public bodies, or is subject to management control by those authorities; or has a management or supervisory body, in which more than the half of the members are appointed by a state or local government body.<a id=\"_ftnref2\" href=\"https:\/\/oldmikinski.mycompany.bg\/en\/2022\/02\/15\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#_ftn2\"><sup>[2]<\/sup><\/a><\/li>\r\n<\/ul>\r\n<strong>II.\u00a0<\/strong><u>IS YOUR ORGANIZATION A CONTROLLER OR PROCESSOR?<\/u>\r\n\r\nThe GDPR gives different quality to the organizations in terms of the processing of personal data they execute.\r\n\r\n<strong>Personal data controller<\/strong>\u00a0means a natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data;\r\n\r\n<strong>Processor of personal data<\/strong>\u00a0means a natural or legal person, public authority, agency or other entity that processes personal data on behalf of a controller of personal data.\r\n\r\nThe criteria for appointing DPO applies equally to both types of organizations. This means that each organization should determine independently, in view of its internal processes and without taking into account its relationships with other organizations, whether there is an obligation to appoint a DPO.\r\n\r\n<strong>III.\u00a0<u>WHAT ARE THE OBLIGATIONS OF THE DPO?<\/u><\/strong>\r\n\r\nThe Data Protection Officer shall have at least the following responsibilities:\r\n<ul>\r\n \t<li>to inform and advise the organization and the employees who process personal data about their obligations under both the GDPR and other applicable provisions in domestic law;<\/li>\r\n \t<li>to monitor compliance with the rules for personal data processing set out in applicable law and in the internal documents of the organization;<\/li>\r\n \t<li>assign responsibilities, raise awareness and train staff involved in processing operations;<\/li>\r\n \t<li>to audit the personal data processing within the organization;<\/li>\r\n \t<li>to give professional opinion and advice in connection with the assessment of the impact of data processing on its protection and to monitor it;<\/li>\r\n \t<li>to cooperate with the CPDP and to act as a contact point between the Commission and the organization it represents on issues related to the processing of personal data;<\/li>\r\n \t<li>DPO may seek prior consultation with the CPDP in connection with the forthcoming processing of personal data, as well as in connection with emerging cases in the activities of the organization.<\/li>\r\n<\/ul>\r\nConsidering the above it can be reasonably concluded that the assessment of whether an organization should appoint a DPO, as well as the selection of an expert or organization to perform the functions of personal data protection officer, is extremely important and responsible process for each business.\r\n\r\nThe choice of such a figure in an organization, whether there is an obligation to do so or not, is undoubtedly a good practice and would be welcomed by the supervisory authorities in the face of the Data Protection Commission, as well as by partners and customers of the organization. On one hand, the understanding and correct application of the internal rules and policies created in the organization for personal data processing is ensured, since the employees are well-trained. On the other hand, communication with the Commission for Personal Data Protection and with the individuals whose data is processed is facilitated.\r\n\r\nAll this inevitably reduces the risk of sanctions by control bodies for the organization, as well as further guarantees to the individuals who have relationship with the organization that their personal data is processed legally and at the necessary level of protection.\r\n\r\n<hr class=\"wp-block-separator\" \/>\r\n\r\n<a id=\"_ftn1\" href=\"https:\/\/oldmikinski.mycompany.bg\/en\/2022\/02\/15\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#_ftnref1\">[1]<\/a>\u00a0The examples are taken from the Guidelines for Data Protection Officers (\u201cDPOs\u201d) of the Article 29 Data Protection Working Party\r\n\r\n<a id=\"_ftn2\" href=\"https:\/\/oldmikinski.mycompany.bg\/en\/2022\/02\/15\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#_ftnref2\">[2]<\/a>\u00a0\u00a743 of the Additional Provisions of the Public Procurement Act\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>In order to answer this question, the provisions of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter referred to in this [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[65],"tags":[76],"class_list":["post-1491","post","type-post","status-publish","format-standard","hentry","category-personal-data-protection-en","tag-before-updates-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners\" \/>\n<meta property=\"og:description\" content=\"In order to answer this question, the provisions of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter referred to in this [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/\" \/>\n<meta property=\"og:site_name\" content=\"Mikinski &amp; Partners\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-27T07:43:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-27T22:35:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/mikinski.bg\/wp-content\/uploads\/2022\/05\/hero3.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"822\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"lp\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"lp\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/\"},\"author\":{\"name\":\"lp\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#\\\/schema\\\/person\\\/4a3dc1a81a14064a0968d71dbcb99177\"},\"headline\":\"How to determine whether we need a data protection officer (DPO)?\",\"datePublished\":\"2022-07-27T07:43:03+00:00\",\"dateModified\":\"2023-04-27T22:35:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/\"},\"wordCount\":1739,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#organization\"},\"keywords\":[\"before-updates\"],\"articleSection\":[\"Personal Data\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/\",\"url\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/\",\"name\":\"How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#website\"},\"datePublished\":\"2022-07-27T07:43:03+00:00\",\"dateModified\":\"2023-04-27T22:35:43+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/home\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to determine whether we need a data protection officer (DPO)?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/\",\"name\":\"Mikinski &amp; Partners\",\"description\":\"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e\",\"publisher\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#organization\",\"name\":\"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e \u041c\u0438\u043a\u0438\u043d\u0441\u043a\u0438 \u0438 \u0421\u044a\u0434\u0440\u0443\u0436\u043d\u0438\u0446\u0438\",\"url\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/mikinski.bg\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/Logo-Mikinski.svg\",\"contentUrl\":\"https:\\\/\\\/mikinski.bg\\\/wp-content\\\/uploads\\\/2022\\\/05\\\/Logo-Mikinski.svg\",\"width\":412,\"height\":95,\"caption\":\"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e \u041c\u0438\u043a\u0438\u043d\u0441\u043a\u0438 \u0438 \u0421\u044a\u0434\u0440\u0443\u0436\u043d\u0438\u0446\u0438\"},\"image\":{\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/mikinski-and-partners-law-office\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/mikinski.bg\\\/en\\\/#\\\/schema\\\/person\\\/4a3dc1a81a14064a0968d71dbcb99177\",\"name\":\"lp\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g\",\"caption\":\"lp\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/","og_locale":"en_US","og_type":"article","og_title":"How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners","og_description":"In order to answer this question, the provisions of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (hereinafter referred to in this [&hellip;]","og_url":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/","og_site_name":"Mikinski &amp; Partners","article_published_time":"2022-07-27T07:43:03+00:00","article_modified_time":"2023-04-27T22:35:43+00:00","og_image":[{"width":1920,"height":822,"url":"https:\/\/mikinski.bg\/wp-content\/uploads\/2022\/05\/hero3.jpg","type":"image\/jpeg"}],"author":"lp","twitter_card":"summary_large_image","twitter_misc":{"Written by":"lp","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#article","isPartOf":{"@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/"},"author":{"name":"lp","@id":"https:\/\/mikinski.bg\/en\/#\/schema\/person\/4a3dc1a81a14064a0968d71dbcb99177"},"headline":"How to determine whether we need a data protection officer (DPO)?","datePublished":"2022-07-27T07:43:03+00:00","dateModified":"2023-04-27T22:35:43+00:00","mainEntityOfPage":{"@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/"},"wordCount":1739,"commentCount":0,"publisher":{"@id":"https:\/\/mikinski.bg\/en\/#organization"},"keywords":["before-updates"],"articleSection":["Personal Data"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/","url":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/","name":"How to determine whether we need a data protection officer (DPO)? | Mikinski &amp; Partners","isPartOf":{"@id":"https:\/\/mikinski.bg\/en\/#website"},"datePublished":"2022-07-27T07:43:03+00:00","dateModified":"2023-04-27T22:35:43+00:00","breadcrumb":{"@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/mikinski.bg\/en\/how-to-determine-whether-we-need-a-data-protection-officer-dpo\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/mikinski.bg\/en\/home\/"},{"@type":"ListItem","position":2,"name":"How to determine whether we need a data protection officer (DPO)?"}]},{"@type":"WebSite","@id":"https:\/\/mikinski.bg\/en\/#website","url":"https:\/\/mikinski.bg\/en\/","name":"Mikinski &amp; Partners","description":"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e","publisher":{"@id":"https:\/\/mikinski.bg\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/mikinski.bg\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/mikinski.bg\/en\/#organization","name":"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e \u041c\u0438\u043a\u0438\u043d\u0441\u043a\u0438 \u0438 \u0421\u044a\u0434\u0440\u0443\u0436\u043d\u0438\u0446\u0438","url":"https:\/\/mikinski.bg\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/mikinski.bg\/en\/#\/schema\/logo\/image\/","url":"https:\/\/mikinski.bg\/wp-content\/uploads\/2022\/05\/Logo-Mikinski.svg","contentUrl":"https:\/\/mikinski.bg\/wp-content\/uploads\/2022\/05\/Logo-Mikinski.svg","width":412,"height":95,"caption":"\u0410\u0434\u0432\u043e\u043a\u0430\u0442\u0441\u043a\u043e \u0434\u0440\u0443\u0436\u0435\u0441\u0442\u0432\u043e \u041c\u0438\u043a\u0438\u043d\u0441\u043a\u0438 \u0438 \u0421\u044a\u0434\u0440\u0443\u0436\u043d\u0438\u0446\u0438"},"image":{"@id":"https:\/\/mikinski.bg\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/mikinski-and-partners-law-office\/"]},{"@type":"Person","@id":"https:\/\/mikinski.bg\/en\/#\/schema\/person\/4a3dc1a81a14064a0968d71dbcb99177","name":"lp","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f9307b294c48244b8747884bd21954194714fc416187f53babd01c77dbd89375?s=96&d=mm&r=g","caption":"lp"}}]}},"_links":{"self":[{"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/posts\/1491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/comments?post=1491"}],"version-history":[{"count":1,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/posts\/1491\/revisions"}],"predecessor-version":[{"id":2615,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/posts\/1491\/revisions\/2615"}],"wp:attachment":[{"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/media?parent=1491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/categories?post=1491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mikinski.bg\/en\/wp-json\/wp\/v2\/tags?post=1491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}