The controller and the processor must designate a data protection officer where (1) they are a public authority prescribed by the Committee; (2) their collection, use or disclosure requires regular monitoring of personal data or systems because of a large amount of personal data as prescribed by the Committee; or (3) their core activity is processing section 26 data. Affiliated businesses or groups may share a DPO if every establishment can easily contact them, as may large public authorities with several establishments. A foreign controller's representative falls under the same duty. The controller or processor must give the DPO's details, address and contact channels to data subjects and the Office. The DPO may be an employee or a contracted service provider; the Committee may set qualifications.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.