5.1 DPO & DPIA

CIPP/E — Certified Information Privacy Professional/Europe Exam

Track your progress as you read

Finished sections get a check mark.

1 CIPP/E Exam Map & Strategy

1.1 Current Exam Facts 1.2 Why CIPP/E & Who Takes It 1.3 The Body of Knowledge Blueprint 1.4 How CIPP/E Items Are Written 1.5 Study Plan & Test Strategy

2 Introduction to European Data Protection

2.1 Origins & Rationale of EU Data Protection 2.2 Human-Rights Framework 2.3 EU Institutions & Legislative Process 2.4 From the 1995 Directive to the GDPR 2.5 Sources of EU Law & Key CJEU Cases

3 GDPR Core Law: Principles, Bases & Rights

3.1 Key Definitions & Material/Territorial Scope 3.2 The Seven Principles (Art. 5) 3.3 The Six Lawful Bases (Art. 6) & Consent (Art. 7) 3.4 Data Subject Rights (Art. 12-22) 3.5 Controller & Processor Obligations + Security

4 Data Processing in Context & International Transfers

4.1 Processing Employee Data 4.2 Surveillance & Direct Marketing 4.3 International Transfer Fundamentals (Ch. V) 4.4 Transfer Mechanisms & Safeguards 4.5 Outsourcing, Cloud & Vendor Management

5 Compliance, Supervision, Enforcement & Final Readiness

5.1 DPO & DPIA 5.2 Personal Data Breach Notification 5.3 Supervisory Authorities, EDPB & One-Stop-Shop 5.4 Enforcement, Remedies & Fines 5.5 Integrated Practice & Final Readiness

Key Takeaways Explain This Topic AI

A Data Protection Officer (DPO) is mandatory under Article 37 when processing is by a public authority, when core activities require regular and systematic monitoring of data subjects on a large scale, or when core activities involve large-scale processing of special-category or criminal-offence data

The DPO must report to the highest management level, cannot be instructed on how to perform tasks, cannot be dismissed for doing the job, and may not hold a conflicting role (Articles 38-39)

A Data Protection Impact Assessment (DPIA) is required under Article 35 when processing is likely to result in a high risk to rights and freedoms, including systematic and extensive profiling, large-scale special-category processing, and large-scale systematic monitoring of public areas

A DPIA must describe the processing, assess necessity and proportionality, assess risks, and identify mitigating measures; the controller must seek the DPO's advice (Article 35(2))

Prior consultation with the supervisory authority is required under Article 36 only when a DPIA shows a high residual risk that the controller cannot mitigate

Last updated: June 2026

Why DPO and DPIA Matter on the Exam

The Data Protection Officer (DPO) and the Data Protection Impact Assessment (DPIA) are two of the most heavily tested accountability tools in the General Data Protection Regulation (GDPR) . Questions are almost always scenario-based: you are given facts about an organisation and asked whether a DPO is mandatory , or whether a DPIA is required . Memorising the three triggers for each is the single highest-yield task in the compliance domain.

Both tools sit under the accountability principle in Article 5(2): the controller must not only comply but be able to demonstrate compliance. The exam exploits the fact that a DPO and a DPIA are independent obligations — you can need one without the other. A small clinic with no DPO obligation may still owe a DPIA; a public authority always needs a DPO but may run no high-risk processing at all. Treat the two analyses as separate decision trees and never let the answer to one collapse into the other.

When a DPO Is Mandatory (Article 37)

Under Article 37(1) , a controller or processor must designate a DPO in three cases:

Trigger Test

Public authority or body Processing carried out by a public authority or body (except courts acting judicially)

Regular and systematic monitoring Core activities consist of processing that, by its nature, requires regular and systematic monitoring of data subjects on a large scale

Large-scale special-category data Core activities consist of large-scale processing of special-category data (Article 9) or criminal-conviction/offence data (Article 10)

Key distinctions the exam exploits:

Core activities means the primary business operations needed to achieve the organisation's goals, not ancillary support like IT, HR, or payroll. A hospital's core activity is patient care (so a DPO is mandatory); an employer running ordinary payroll is not processing health data as a core activity.

Large scale is judged on the number of data subjects, the volume and range of data, the duration of processing, and the geographical extent . A single physician's patient files are not large scale; a hospital's are.

Regular and systematic monitoring explicitly includes all forms of online tracking and behavioural advertising — the WP29/EDPB guidance lists this expressly.

A group of undertakings may appoint a single DPO (Article 37(2)) provided the DPO is easily accessible from each establishment.

The DPO may be a staff member or an external contractor (Article 37(6)), and the contact details must be published and communicated to the supervisory authority (Article 37(7)).

DPO Position and Tasks (Articles 38-39)

Article 38 protects DPO independence. The controller must:

Involve the DPO properly and in a timely manner in all data-protection matters
Provide resources, access to personal data and processing operations, and support to maintain expertise
Ensure the DPO does not receive instructions regarding the exercise of tasks
Ensure the DPO is not dismissed or penalised for performing the role
Have the DPO report to the highest management level

The DPO must also avoid conflicts of interest : they cannot hold a position that determines the purposes and means of processing, so a CEO, COO, head of marketing, head of HR, or head of IT generally cannot also be DPO.

Article 39 lists the DPO's tasks: informing and advising on obligations; monitoring compliance and awareness-raising/training; advising on and monitoring the performance of DPIAs; cooperating with the supervisory authority; and acting as the contact point for the supervisory authority and for data subjects on processing matters. A critical exam trap: the DPO advises and monitors but is not personally liable for the organisation's compliance — that liability stays with the controller. The DPO is also not responsible for deciding whether to proceed with high-risk processing; that decision belongs to management.