The data protection officer (DPO)

The law calls this role the “data protection officer” (in Albanian, nëpunës i mbrojtjes së të dhënave). In practice it is known by the international abbreviation DPO.

When it is mandatory (Article 33)

• Where the processing is carried out by a public authority or body, except courts acting in their judicial capacity.
• Where the core activities of the controller or processor require regular and systematic monitoring of data subjects on a large scale.
• Where the core activities involve large-scale processing of sensitive data or criminal data.

In other cases the appointment is voluntary, or may be required by another law. A group of companies may appoint a single officer, provided the officer is easily reachable from each company.

Who can be appointed (Article 34(2))

• The officer is appointed on the basis of certified professional skills and good knowledge of data protection law and practice.
• The officer may be an employee of the organization or a person under a service contract, that is, an outsourced DPO.
• The officer may have other duties, but they must not create a conflict of interest.

Tasks (Article 34(1))

• Advises the management bodies on all data protection matters.
• Takes part in impact assessments.
• Informs, advises and trains staff.
• Monitors compliance with the law and with internal policies, including audits.
• Cooperates with the Commissioner and acts as its contact point.

Guarantees of independence

• Receives no instructions on how to carry out the tasks.
• Is not dismissed or penalized for performing them.
• Reports directly to the highest level of management.
• Is involved in good time in all data protection matters and has the necessary resources.

Publication and notification

The organization publishes the officer's contact details and notifies them to the Commissioner. Any person may contact the officer about the processing of their own data and the exercise of their rights (Article 34(3)).