Independent role mandated by GDPR Art. 37 for public authorities and certain large-scale processors.
A Data Protection Officer is required under GDPR Art. 37 when (a) processing is by a public authority, (b) core activities involve large-scale systematic monitoring, or (c) core activities involve large-scale processing of special-category or criminal data. The DPO must be independent and reportable to the highest management level.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.