RCM
Core legal framework
DPO · DEFINITION AND DUTIESWhat is a Data Protection Officer?
What is a Data Protection Officer?
Role, duties and independence.
A Data Protection Officer, or DPO, advises the organisation, monitors compliance and cooperates with the supervisory authority. The DPO does not make the organisation’s business decisions and cannot guarantee absolute compliance.
A DPO is an independent data protection adviser whose core tasks are defined in Articles 37 to 39 GDPR. The DPO informs, advises and monitors; supports data protection impact assessments; and acts as a contact point for regulators and individuals. The role may be performed by an employee or under a service contract.
Independence required
The DPO advises
The five core duties of a DPO
Inform and advise
Explain relevant data protection duties to leadership, project owners and teams processing personal data.
Monitor compliance
Review controls, documentation and the organisation’s compliance programme without replacing operational owners.
Advise on DPIAs
Help decide whether an impact assessment is required, advise on its method and monitor the agreed risk treatment.
Cooperate with regulators
Serve as a contact point for the competent authority and support access to the information it requires.
Remain accessible
Provide a channel through which individuals can raise questions concerning processing and their rights.
When is a DPO mandatory?
Public bodies
Appointment is generally required for public authorities and bodies, except courts acting in their judicial capacity.
Large-scale monitoring
A DPO may be mandatory when core activities involve regular and systematic monitoring of individuals on a large scale.
Large-scale sensitive data
Appointment may also be required when core activities involve large-scale processing of special-category data or criminal data.
Internal and outsourced DPO models
Internal DPO
An employee can hold the role if they receive sufficient time, resources, senior access and protection from conflicts of interest.
Outsourced DPO
A service provider may perform the role under a contract defining scope, availability, volumes, escalation and independence.
Same accountability
Outsourcing the role does not transfer the controller’s or processor’s legal responsibility to the DPO.
What about Morocco? The DPO, Law 09-08 and the CNDP
Two distinct frameworks
Law 09-08 does not organise the DPO function in the same way as GDPR Articles 37 to 39. It does require prior formalities with the CNDP, security measures and respect for individuals’ rights.
When the GDPR applies
A Moroccan company can fall under the GDPR when it targets or monitors people in the European Union. The Article 37 appointment criteria must then be assessed.
Suppliers to EU clients
Call centres, IT services firms and SaaS vendors receive questionnaires and Article 28 contracts. An identified data protection contact makes these reviews and the evidence behind them easier.
A lead for formalities
Even without a legal duty to appoint, a DPO or privacy lead coordinates the record of processing, CNDP filings, international transfers and incident response.
IMPLEMENTATION GUIDE
Move from checklist to a documented decision
How to assess whether appointment is mandatory
The assessment is not determined by headcount alone. Identify the organisation’s core activities, the nature of any monitoring, the number of individuals affected, the duration of processing and its geographic reach. A smaller operation may still create significant risk where monitoring is intrusive or continuous, or where special-category data is processed at scale.
Record the conclusion together with the facts and criteria considered. An organisation may appoint a DPO voluntarily even when Article 37 does not require one, but the GDPR requirements attached to the function then apply. A separate privacy lead may be appropriate in other cases, provided the title, authority and communications do not misleadingly present that person as a formally designated DPO.
Independence, resources and conflicts of interest
The DPO needs timely access to processing information, decision makers and senior management. Budget, time and tools should be proportionate to the assigned scope. Independence does not mean isolation: business owners, security, HR, marketing and leadership retain responsibility for decisions, corrective actions and the evidence needed to demonstrate that controls operate.
A conflict may arise when the same person determines the purposes and essential means of processing that they are expected to monitor. Job title alone is not decisive; actual decision-making powers must be examined. For an outsourced DPO, the service contract should also address the provider’s other engagements, confidentiality, continuity, escalation and the availability of a named lead.
What an effective DPO arrangement should deliver
An effective arrangement converts legal questions into traceable decisions. Depending on scope, this may include an annual control plan, an updated record of processing, project opinions, DPIA oversight, a rights-request channel, breach coordination, vendor review and reporting to leadership. The exact deliverables and response commitments should be stated in the service schedule.
A DPO does not automatically sign decisions for the organisation, perform every technical control or replace external counsel where reserved legal advice is required. When comparing proposals, ask how much expert time is included, who the named DPO is, which response times and volumes apply, what remains with internal owners and how out-of-scope work is approved and priced.
FAQ
Frequently asked questions
Must a Moroccan company appoint a DPO?+
Law 09-08 has no mechanism identical to GDPR Article 37. If the GDPR applies to its activities, the company must assess the appointment criteria; a privacy lead remains useful to manage CNDP formalities.
What does DPO stand for?+
DPO stands for Data Protection Officer.
Does a DPO make a company GDPR compliant?+
No. The DPO advises and monitors. The organisation remains accountable for its processing and decisions.
Does every small business need a DPO?+
No. The Article 37 criteria and any applicable sector-specific rules must be assessed.
Can the DPO be outsourced?+
Yes. Article 37 permits the role to be performed under a service contract.
Is an outsourced DPO the same as an EU representative?+
No. A DPO and an Article 27 EU representative have different functions and establishment requirements.
This guide provides a general framework and does not replace an assessment of your circumstances or reserved legal advice.
RCM
Explore outsourced DPO services →Need outsourced DPO services?
Define the scope, availability and responsibilities before choosing a monthly plan.