How do you notify the appointment of a data protection officer (DPO)?
FORMAL ANSWER
The appointment of a data protection officer must be notified to the President of the UODO within 14 days, stating the officer's first name, surname and email address or telephone number, as well as: 1. the first name and surname and residential address, where the controller or processor is a natural person; 2. the business name and address of the place of business, where the controller or processor is a natural person conducting business activity; 3. the full name and registered office address, where the controller or processor is an entity other than those referred to in points 1 and 2; 4. the REGON identification number, if one has been assigned to the controller or processor.
Where a single data protection officer is appointed by public authorities or bodies or by a group of undertakings, each of those entities must submit the notification. Within 14 days, any change to that information or the removal of the officer must also be notified. Notifications must be prepared in electronic form and signed with a qualified electronic signature or a signature confirmed via the trusted ePUAP profile.
The entity that has appointed a data protection officer should also publish the officer's first name, surname and email address or telephone number on its website, or, if it does not have one, at its place of business.
PRACTICAL ANSWER
Within 14 days of appointing a data protection officer, you must notify the Polish DPA — following its instructions. If the entity that appointed the officer uses a representative for this purpose, proof of payment of the stamp duty on the power of attorney should be attached to the form, unless the representative is the entity's spouse, ascendant, descendant or sibling. In addition, the entity should publish the officer's first name, surname and email address or telephone number on its website. If in doubt, it is worth visiting the page of questions and answers maintained by the President of the UODO.
MORE
- You can find more information in the guide: How to process personal data
