Article 39 lists the main (but not all) tasks that fall under the remit of the Data Protection Officer (DPO). Among them, there are three main functions (although DPO competences are not necessarily limited to them):

1. Consulting (39.1a, c),
2. Control / monitoring (39.1b),
3. Relationship with the supervising authorities (39.1d, e).

1. The consulting function means that the DPO provides information and explanations about the GDPR and its compliance to the controller and processor as well as to the employees of the controller and processor who are involved in the processing of personal data. In particular the role of DPO is important in the context of Data Protection Impact Assessment (DPIA), because DPO advises and monitors its implementation according to Article 35 of the GDPR. WP29 recommends that the controller seeks the advice of the DPO, e.g. on the following issues:

• whether or not to conduct a DPIA

ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27002, section 6.1.1.

Here is the relevant paragraph to article 39 GDPR:

6.3.1.1 Information security roles and responsibilities

Implementation guidance

The organization should designate a point of contact for use by the customer regarding the processing of PII. When the organization is a PII controller, designate a point of contact for PII principals regarding the processing of their PII (see 7.3.2).