The owner of the data bank, the controller and the processor appoint a Personal Data Officer where the processing is carried out by a public entity, where they process large volumes of personal data by quantity or type or affecting many people or sensitive data or with evident harm to other rights, or where their core activities involve processing sensitive data; a corporate group may appoint one Officer reachable from every establishment and public bodies may share one; the Officer's contact details are published where data subjects can see them and communicated to the National Authority within 15 days of designation or update; the Officer is appointed for accredited knowledge and experience in data protection, may hold other functions or be external, and at least informs and advises the organisation and its staff on their obligations, verifies and reports on compliance with the Law, the Regulation and the organisation's policies including responsibility assignment, awareness, training and audits, cooperates with the Authority and is its point of contact, with due regard to the risks of the processing. For private organisations the duty applies progressively by annual sales: above 2,300 UIT from 30 November 2025, 1,700 to 2,300 UIT from 2026, 150 to 1,700 UIT from 2027, micro-enterprises from 2028.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.