DPO responsibilities under GDPR Articles 37–39

A DPO advises, monitors and supports data protection work, but who makes the decisions? This guide explains GDPR Articles 37–39, the safeguards that protect the role and how organisations can assign responsibilities clearly in practice.

A data protection officer must inform and advise, monitor compliance, advise on data protection impact assessments where requested and monitor their performance, cooperate with the supervisory authority and act as its contact point. These minimum tasks appear in GDPR Article 39. Article 38 governs the DPO’s position, while Article 37 covers designation. The organisation retains responsibility for compliance. 

Consider a team introducing a new customer database. It asks its DPO to approve the system and take responsibility for every compliance decision. Before assigning the work, the team needs to distinguish independent advice from organisational decision-making.

That distinction matters when you accept a DPO role, assign privacy tasks or respond to a project request. The legal duties give the role substance, but they do not transfer every operational responsibility to one person.

What do Articles 37, 38 and 39 each cover?

The three articles address different questions. Reading them together helps explain how a designated DPO can perform the work.

Article 37 includes requirements concerning professional expertise and the publication and communication of contact details. Germany also has additional appointment rules, but appointment thresholds are a separate assessment from the duties discussed here.

A controller determines the purposes and means of processing; a processor processes personal data on its behalf. Both can have DPO-related obligations.

The 🟧 European Data Protection Board’s DPO guide explains the relationship between designation, position and tasks.

What are the DPO’s five minimum tasks under Article 39?

Article 39(1) sets out five minimum tasks. The 🟧 Article 39 text reproduced by Deutsche Rentenversicherung provides the paragraph-by-paragraph wording. 

The practical examples below illustrate ways to apply these duties. They are not additional statutory procedures.

Inform and advise: Article 39(1)(a)

The DPO informs and advises the controller or processor and employees carrying out processing about their obligations under the GDPR and other applicable EU or national data protection provisions.

For example, consider a project team that wants to reuse customer information for a new purpose. The DPO can explain the questions that need assessment, identify missing information and advise on relevant obligations.

Useful advice connects the requirement with the decision in front of the team.

Monitor compliance: Article 39(1)(b)

Monitoring covers the GDPR, other applicable data protection provisions and the organisation’s personal-data policies. It includes responsibility assignment, awareness, staff training and related audits.

For practical monitoring, ask whether documented arrangements match what happens. A policy might name a responsible team, but that team may not know how requests reach it.

A DPO can investigate the gap and explain the finding. Assigning corrective work and implementing the response require clear organisational ownership.

Advise on DPIAs and monitor their performance: Article 39(1)(c)

The DPO provides advice where requested about a data protection impact assessment, or DPIA, and monitors its performance under Article 35.

This is not a universal duty to personally conduct every DPIA. The controller’s responsibilities and the DPO’s contribution must be distinguished.

For example, the DPO might question whether an assessment sufficiently considers risks to individuals. The project owner and relevant specialists provide the processing information and implement the agreed measures.

The 🟧 European Commission’s guidance on organisational obligations provides broader DPIA context. 

Cooperate with the supervisory authority: Article 39(1)(d)

The DPO cooperates with the supervisory authority.

In practice, this can involve helping clarify processing arrangements and facilitating access to relevant information through appropriate organisational channels.

A useful preparation measure is to identify who holds the documents needed to answer questions. Cooperation is harder to organise when records are scattered and responsibilities unclear.

Act as the authority’s contact point: Article 39(1)(e)

The DPO acts as the supervisory authority’s contact point on processing matters, including Article 36 prior consultation, and consults where appropriate on other matters.

Keep this distinct from individuals’ access to the DPO under Article 38(4). Both contact functions matter, but their legal references differ.

Contact arrangements should make it possible to reach the right person without confusing a DPO enquiry with a general customer-service request.

What does Article 38 require from the organisation?

Duties are difficult to perform without access, time and an appropriate reporting route. Article 38 addresses the conditions in which the DPO works.

Involvement, resources and independence

The organisation must involve the DPO properly and in a timely manner in personal-data matters. It must provide necessary resources, access to personal data and processing operations, and support for maintaining expertise.

The DPO must not receive instructions about exercising DPO tasks, must not be dismissed or penalised for performing them, and reports directly to the highest management level. These safeguards are explained in the 🟧 EDPB guide. 

For the customer-database example, inviting the DPO only after launch restricts the opportunity for useful advice. A practical project process should identify when information reaches the DPO and how unresolved concerns reach management.

Confidentiality and other duties

Article 38 also addresses confidentiality and the ability of individuals to contact the DPO about processing and exercising their rights.

Additional tasks are possible, but they must not create conflicts of interest. The organisation needs to assess actual responsibilities, including whether the person determines processing purposes and means.

The 🟧 BayLDA FAQ explains conflicts and the effect of additional work on available time. For a fuller examination of suitability, consult 🟦 DPO eligibility and conflicts of interest.

Who is responsible for implementation?

The DPO’s advice and monitoring do not remove organisational accountability. The 🟧 BayLDA overview distinguishes the DPO role from the organisation’s retained responsibility. 

Use the following practical allocation as a discussion starting point, rather than an exhaustive legal responsibility chart.

Do not turn the table into a blanket prohibition on operational support. EDPB guidance notes that maintaining processing records is often assigned to DPOs in practice. Additional tasks still need appropriate conflict assessment. 

The useful question is whether the arrangement enables independent performance of the DPO tasks while preserving clear responsibility for decisions and action.

For example, asking a DPO to help improve a template is different from making that person responsible for deciding the purposes and means of processing and then independently reviewing those same decisions.

How should the DPO prioritise work?

Article 39(2) requires due regard to processing risks, considering the nature, scope, context and purposes of processing. 

A practical work plan should therefore explain why some matters need earlier or deeper attention.

Consider two hypothetical findings: an incomplete contact field in an internal document and an unresolved access concern affecting sensitive records. Their implications may differ. Assess the facts and applicable requirements before assigning urgency.

Risk-based prioritisation does not mean that lower-priority duties disappear or that binding deadlines can be ignored. It helps organise the depth and timing of work within the relevant obligations.

Record the reasoning where it matters, especially when limited resources affect the plan.

A new customer database: the role in practice

Return to the hypothetical project team from the introduction.

The team is replacing several spreadsheets with a shared customer database. It has chosen a supplier, but has not clearly described which departments need access or how information will be used.

A recommended working sequence is:

1. The project team supplies the facts. It describes intended purposes, data, access, recipients and retention arrangements.

2. The DPO advises. The DPO identifies questions, explains relevant obligations and advises on the need for closer assessment.

3. Responsible functions decide and implement. Management and relevant teams address the advice, assign actions and configure the process.

4. The DPO monitors follow-up. The DPO reviews relevant evidence and communicates remaining concerns.

This example illustrates why advice, decisions and implementation should be visible rather than hidden inside a request for “DPO approval”. Following the sequence does not, by itself, establish that processing is lawful.

For broader organisational context, GCI’s 🟩 strategic data protection in practice discusses how privacy work connects with governance.

Turn the legal duties into a workable role

Use these recommended questions to review the working arrangement:

• When are projects and incidents brought to the DPO’s attention?

• Can the DPO obtain relevant information?

• Are time, support and continued development addressed?

• Is direct reporting to highest management workable?

• Have additional responsibilities been assessed for conflicts?

• Who owns implementation and corrective actions?

• How are unresolved concerns followed up?

A short advice record can help:

This is a practical documentation suggestion, not a prescribed GDPR template or universal annual-report requirement. Choose reporting arrangements appropriate to the organisation without presenting them as fixed statutory schedules.

Prepare for the responsibilities

Connect preparation with the tasks you expect to perform. Our 🟦 guide to DPO certification and qualifications in Germany explains how training relates to expertise and appointment.

GCI’s 🟪 Data Protection Officer (DPO) Certification Training lists GDPR, BDSG, DPO role, DPIA and audit topics. Review its curriculum, assessment and certificate details against your needs.

Completing training does not automatically establish suitability for a particular DPO appointment.

🟪 View the DPO course curriculum