DPO across the Nordics

Companies can appoint a DPO on a mandatory or voluntary basis. Companies must appoint a DPO when the core activities of the processing activities are on a large scale and involves:

• Regular and systematic monitoring, or
• Special categories of data, or
• Criminal convictions and offenses

Mandatory or voluntary, many companies choose to exploit the possibility of designating a single group wide DPO. However, that single DPO still needs to have the necessary skills across the countries the position covers.

Considerations when appointing a DPO

DPO requirements are largely identical across the Nordics. However, when having a single DPO established outside the Nordics, these requirements may be difficult to satisfy.

Single DPOs with responsibilities across various countries may especially have difficulty proving that the following conditions are satisfied for each legislation:

• Easily accessible from each establishment
• Able to inform and advise on the relevant data protection obligations
• Equipped with the relevant resources (financially, logistically, etc.)
• Able to communicate with data subjects, authorities, etc.
• Ready to cooperate with the authorities, if necessary

Depending on the size and structure of the group, more DPOs or a DPO team may be necessary to fulfil these requirements in more than one member state. The DPO team would then consist of the appointed DPO and the DPOs staff.

The reason is that many of the requirements indirectly will make it difficult if not impossible to have one single DPO. For example, the accessibility requirement applies towards data subjects, authorities, as well as generally within the organization internally. And the ability to communicate with data subjects, which may not speak or understand anything but the local language. For example, the Norwegian Data Protection Authority has expressly stated its position that the DPO must be able to communicate in the “Scandinavian languages” as a minimum.

IUNOs opinion

DPO requirements are largely streamlined across the Nordics. Therefore, companies preferring a few DPOs across several legislations may prefer to appoint one internal or external DPO or team member with the necessary skills for the Nordics.

IUNO recommends that companies get a clear overview of the applicable rules and nuances within each member state to ensure that the DPO satisfies the requirements. Alternatively, companies can also outsource the DPO assignment externally. In that case, it is important to ensure that the external DPO can document that all the applicable requirements are satisfied on the company’s behalf.

IUNO provides DPO services across the Nordics. You can read more here.