Must the data protection information notice include the Data Protection Officer's full name?

ANSWER

Under the information obligation set out in Articles 13 and 14 GDPR, and in other justified cases, the data controller is required to provide the DPO's "contact details" where a DPO has been designated. This should be understood as information enabling contact with the DPO, such as a telephone number or email address. There is no requirement to provide more detailed personal data, such as the DPO's first and last name.

This position has also been confirmed in legal doctrine — in the 2018 GDPR commentary edited by Dr Marlena Sakowska-Baryła:

"The information obligation must also include the contact details of the Data Protection Officer — naturally, where the controller has designated one. With regard to the scope of the concept of the DPO's 'contact details', it is worth referring to the Article 29 Working Party Guidelines on Data Protection Officers (WP 243), which indicate that such details should include information enabling data subjects and supervisory authorities to contact the DPO easily. These include: a postal address, contact telephone number, dedicated email address, and, where appropriate, other means of communication made available to the public, such as a dedicated helpline or a contact form with the DPO on the organization's website. This appears justified, especially since under Article 38(4) GDPR, data subjects may contact the Data Protection Officer on all matters relating to the processing of their personal data and the exercise of their rights under the GDPR. It would not be possible to ensure such contact if the data subject cannot obtain the DPO's contact details in order to reach the person they wish to contact."