Article 24

Appointment and tasks of the Data Protection Officer 1. Each Community institution and Community body shall appoint at least one person as data protection officer. That person shall have the task of: ensuring that controllers and data subjects are informed of their rights and obligations pursuant to this Regulation; responding to requests from the European Data Protection Supervisor and, within the sphere of his or her competence, cooperating with the European Data Protection Supervisor at the latter's request or on his or her own initiative; ensuring in an independent manner the internal application of the provisions of this Regulation; keeping a register of the processing operations carried out by the controller, containing the items of information referred to in Article 25(2); notifying the European Data Protection Supervisor of the processing operations likely to present specific risks within the meaning of Article 27. That person shall thus ensure that the rights and freedoms of the data subjects are unlikely to be adversely affected by the processing operations. 2. The Data Protection Officer shall be selected on the basis of his or her personal and professional qualities and, in particular, his or her expert knowledge of data protection. 3. The selection of the Data Protection Officer shall not be liable to result in a conflict of interests between his or her duty as Data Protection Officer and any other official duties, in particular in relation to the application of the provisions of this Regulation. 4. The Data Protection Officer shall be appointed for a term of between two and five years. He or she shall be eligible for reappointment up to a maximum total term of ten years. He or she may be dismissed from the post of Data Protection Officer by the Community institution or body which appointed him or her only with the consent of the European Data Protection Supervisor, if he or she no longer fulfils the conditions required for the performance of his or her duties. 5. After his or her appointment the Data Protection Officer shall be registered with the European Data Protection Supervisor by the institution or body which appointed him or her. 6. The Community institution or body which appointed the Data Protection Officer shall provide him or her with the staff and resources necessary to carry out his or her duties. 7. With respect to the performance of his or her duties, the Data Protection Officer may not receive any instructions. 8. Further implementing rules concerning the Data Protection Officer shall be adopted by each Community institution or body in accordance with the provisions in the Annex. The implementing rules shall in particular concern the tasks, duties and powers of the Data Protection Officer.

← 3. · All articles · art_24__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.