Throughout 2023, 26 Data Protection Authorities (DPAs) across the EEA (including the European Data Protection Supervisor) will take part in the EDPB’s coordinated enforcement programme for 2023 on the designation and position of Data Protection Officers (DPOs).

The EDPB says that as intermediaries between DPAs, individuals and business, DPOs play an essential role in contributing to compliance with data protection law and promoting effective protection of data subject rights. To gauge whether organisations are complying with the requirements of Articles 37-39 of the GDPR in relation to the position of DPOs and providing the resources needed to carry out their tasks, participating DPAs will conduct fact-finding exercises by sending out questionnaires to DPOs and ascertain whether formal investigations are warranted. They will then undertake and follow-up on any necessary formal investigations.

The results will be analysed and DPAs will decide on possible national supervision and enforcement. In addition, results will be aggregated, generating deeper insight and allowing targeted follow-up at EU level. The EDPB will publish a report on the outcome of this analysis once the actions are concluded.

This is the second programme to be conducted under the EDPB’s Coordinated Enforcement Framework (CEF). CEF initiatives aim to streamline enforcement and cooperation among DPAs. The first programme under the CEF in 2022 covered the use of cloud services by the public sector. A report on the findings was published in January 2023. To read the EDPB’s press release in full, click here.