Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 39 – Tasks of the data protection officer

Articles

Article 39Tasks of the data protection officer

1. The data protection officer shall have at least the following tasks:

(a)
to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to [^F1other domestic law relating to data protection];
(b)
to monitor compliance with this Regulation, with [^F2other domestic law relating to data protection] and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c)
to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d)
to cooperate with [^F3the [^F4Commission]];
(e)
to act as the contact point for [^F5the [^F4Commission]] on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

2. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

Amended text

This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations and footnotes

Textual Amendments

F1 Words in Art. 39(1)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 33(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F2 Words in Art. 39(1)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 33(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F3 Words in Art. 39(1)(d) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 33(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
F4 Word in Art. 39(1)(d)(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 41(3)(4)(n); S.I. 2026/1015, reg. 2(c)
F5 Words in Art. 39(1)(e) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 33(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

https://uk-gdpr.digiphile.law/article/article-39.html

Text as at 17 September 2026.

This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.