Article 28

The Management Board shall appoint, on the proposal of the Director, a Data Protection Officer who shall be a member of the staff. In the performance of his or her duties, he or she shall act independently. The Data Protection Officer shall in particular have the following tasks: ensuring, in an independent manner, lawfulness and compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data relating to Europol staff; ensuring that a written record of the transmission and receipt of personal data is kept in accordance with this Decision; ensuring that data subjects are informed of their rights under this Decision at their request; cooperating with Europol staff responsible for procedures, training and advice on data processing; cooperating with the Joint Supervisory Body; preparing an annual report and communicating that report to the Management Board and to the Joint Supervisory Body. In the performance of his or her tasks, the Data Protection Officer shall have access to all the data processed by Europol and to all Europol premises. If the Data Protection Officer considers that the provisions of this Decision concerning the processing of personal data have not been complied with, he or she shall inform the Director, requiring him or her to resolve the non-compliance within a specified time. If the Director does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall inform the Management Board and shall agree with the Management Board a specified time for a response. If the Management Board does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall refer the matter to the Joint Supervisory Body. The Management Board shall adopt further implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern selection and dismissal, tasks, duties and powers and safeguards for the independence of the Data Protection Officer.

← art_27__text_1 · All articles · 1. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.