How many GDPR specialists should an employer hire?

ANSWER

Personal data protection regulations do not provide any guidelines regarding the number of data protection specialists that a controller must have depending on the size of the organisation. It is for the controller to determine how many persons (one or more, e.g. three) will be able to handle the organisation of personal data processing within the organisation. The only requirement imposed by the GDPR is the appointment of a data protection officer when the conditions set out in Article 37(1)(a), (b) or (c) GDPR are met. The requirement to have a DPO is not, however, dependent on the size of the organisation. The decision as to how many specialists a data controller should have therefore rests with the controller itself.