The role of Representative and Data Protection Officer + - Opozorilo: Mnenje je bilo izdano na podlagi določb Zakona o varstvu osebnih podatkov (ZVOP-1, Uradni list RS, št. 94/07 - uradno prečiščeno besedilo), ki je z dnem
- 2023 prenehal veljati in ga je nadomestil nov Zakon o varstvu osebnih podatkov (ZVOP-2, Uradni list RS, št. 163/22), zato mnenje ni več nujno aktualno. Mnenja po ZVOP-2 so na voljo tukaj. Datum: 15.10.2020 Številka: 07126-1/2020/55 Kategorije:Pogodbena obdelava podatkov, Pooblaščene osebe za varstvo podatkov (»DPO«) --> Kategorije: Pogodbena obdelava podatkov, Pooblaščene osebe za varstvo podatkov - DPO The Information Commissioner (Slovenian National Supervisory Body for Personal Data Protection) received your questions regarding the role of an organization's GDPR Article 27 representative ("EU Representative") as well as an organization’s Data Protection Officer ("DPO"), in circumstances where that EU Representative or DPO is a third party (not an employee of the organization): Do third party EU Representatives and DPOs act as data controllers, data processors or sub-processors in terms of the personal data which they process on behalf of the organization which they represent or perform a DPO function for? By way of example, a third party EU Representative or a DPO may receive a data subject rights request on behalf of a foreign entity. In the course of handling the request, the EU Representative or DPO will have to process personal data of the organization’s data subjects, or potentially even data subjects whose personal data has not been previously processed by the organization at all. In this case, will the EU Representative or DPO be considered a data controller, a data processor or a sub-processor of the organization which they represent? As requested, please find below answers to your questions: The Information Commissioner has not issued any guidance related to the topic and does not have any official point of view or recommended procedure in connection with the establishment of the relationship between a controller/processor and an external DPO or EU Representative. Based on a preliminary assessment of the question, we have the following interpretation. We believe that, in principle, an external DPO cannot act as processor or sub-processor taking into account the GDPR provisions; in particular those stating that the DPO should act independently. Namely, an external DPO should be the subject of all provisions concerning the tasks and position of the DPO laid down in Articles 38 and
- According to Article 28
(3)(a) processor can only process the personal data on documented instructions from the controller. The DPO, however, cannot receive any instructions regarding the exercise of his tasks (Article 38
(3)). Besides this, the role and tasks of the DPO (monitoring compliance, providing advice to the controller or processor, etc.) are different from those of a processor. Processing data on behalf of the controller is not the core activity of a DPO. This is why a data processing agreement pursuant to Article 28 is not required and the service contract referred to in Article 37
(6)and Recital 80 is the only obligation and as such sufficient basis for access to controller’s data and processing operations. An EU Representative of the controller/processor has fundamentally different role and tasks as a DPO (Article 27). However, as is the case with the DPO, its main task is not processing data on behalf of the controller. Therefore we assume that the written mandate referred to in Article 27
(4)and Recital 80 is the adequate legal basis for processing controller’s/processor’s data. *** Where requests from data subjects are received by any kind of DPO or EU Representative, they are, in our view, considered to be received by the controller/processor, as they act as contact points. Therefore and in line with the above, we do not see any difference between the data subject request received by an external or internal DPO. Kind regards, Mojca Prelesnik, Information Commissioner of the Republic of Slovenia O NAS Informacijski pooblaščenec Dunajska cesta 22 1000 Ljubljana, Slovenija Zemljevid (vir: najdi.si) Telefon: 01 230 97 30 Poštni in varni e-predal: gp.ip(at)ip-rs.si Odgovorna oseba za informacije za medije: dr. Jelena Virant Burnik. Kontakt za medije: Barbara Repovš, mediji@ip-rs.si ali 01 230 97 30 Prijava kršitev (Navodila in obrazci) URADNE URE PON - PET 9.00 - 12.00 POVEZAVE Informacije javnega značaja Priročniki in smernice Obrazci Politika zasebnosti Informacije o obdelavi osebnih podatkov Izjava o dostopnosti Podpora za majhna podjetja Pravice posameznikov Prijava na prejemanje e-novic Informacijski pooblaščenec | 2026