GDPR for businesses: when a DPO is required and how employee activity may be monitored

Start with the purpose and basis of each processing activity

For each activity, establish why data is needed, the legal basis, who has access and retention periods. GDPR requires lawfulness, transparency, purpose limitation, data minimisation, accuracy and security. The company must be able to demonstrate compliance.

Consent is not a universal processing basis. Contract performance, legal obligations and legitimate interests may apply under their respective conditions. In employment, a blanket consent statement does not justify every use of employee data.

Privacy notices, processor agreements, access rules and request or incident procedures should reflect actual data flows. Transfers to recipients outside the European Economic Area require assessment of applicable mechanisms.

When a DPO must be appointed

Article 37 GDPR specifies three principal situations where appointment is mandatory:

• Processing by a public authority or body, except courts acting in their judicial capacity.
• Core activities involving processing requiring regular and systematic monitoring of individuals on a large scale.
• Core activities consisting of large-scale processing of special categories of data or data relating to criminal convictions and offences.

The assessment goes beyond employee numbers

Article 37 does not set a general employee or turnover threshold. For scale, the supervisory authority identifies the number of data subjects, data volume and variety, duration and geographical extent. Core activities and the nature of processing matter, not organisational size alone.

Romanian law adds relevant requirements. Article 4(2) of Law No. 190/2018 requires safeguards, including a DPO, where national identification numbers or documents containing them are processed on the basis of legitimate interests. This must be distinguished from processing the same data to comply with a legal obligation.

The officer’s role and independence

A DPO may be an employee or external provider. They need suitable expertise, access to information and resources, and timely involvement in data decisions. They advise, monitor compliance and cooperate with the supervisory authority.

The DPO reports directly to the highest management level and must not receive instructions on performing their specific tasks. Other roles are permissible only without conflicts of interest. Contact details must be published and notified to the authority under Article 37(7).

Employee monitoring: cumulative requirements

For workplace monitoring through electronic communications or video surveillance based on the employer’s legitimate interests, Article 5 of Law No. 190/2018 requires all of the following:

• A duly justified employer interest that outweighs the interests or rights and freedoms of the individuals concerned.
• Prior, complete and explicit information to employees.
• Consultation with the trade union or employee representatives before introducing the systems.
• Evidence that less intrusive methods have previously proved ineffective.
• Retention proportionate to the purpose, normally no more than 30 days, except where expressly regulated by law or duly justified.

Documenting the decision before implementation

A camera or application installed for security does not automatically authorise continuous evaluation of employee behaviour. Purpose, access, retention and subsequent uses require assessment. Where processing may create a high risk, the obligation to conduct a data protection impact assessment must be checked.

Murar și Asociații assists companies in assessing GDPR obligations, reviewing documents and supplier relationships, evaluating workplace monitoring and handling requests or regulatory inspections.

Useful questions

Related legal services

• Employment law for businesses