Our organization has determined whether a data protection officer should be appointed and, if so, made an appointment.

The Data Protection Officer shall be appointed if:

• the organization handles sensitive information on a large scale
• the organization monitors people on an extensive, regular, and systematic basis
• the organization is a public administration actor

In addition to the appointment, it is essential to regularly assess whether the Data Protection Officer is acting in the role and performing the tasks required by the Data Protection Regulation.

The organization shall publish the contact details of the data protection officer (e.g. on the organisation's website) and inform the supervisory authority.

The organization shall have a sufficient number of trained, supervised and, where necessary, properly security cleared personnel who play key roles in information security, performing management tasks related to the information security management system.

The organization has defined:

• what qualifications this staff should have
• how qualifications are acquired and ensured (e.g. through appropriate training and training monitoring)
• how qualifications can be demonstrated through documentation

The owner of the task regularly reviews the number and level of competence of the security personnel.