The data protection officer has left, the supervisory authority still has his name

Four years ago, the data protection officer was appointed. The certificate of appointment is in management's file, the notification to the supervisory authority went out on the form, and the privacy notice shows his address. Everything done right.

In spring, he retired. His successor has been chosen internally, and a circular email told everyone. The supervisory authority still has the old name, the website the old address, and a data subject's request lands in a mailbox nobody reads any more.

What the GDPR requires

The obligation does not end with the appointment. Article 37(7) GDPR reads:

"The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority."

The sentence applies to the current person, not the first one. Whoever changes has to do both again: publish and communicate. An appointment therefore has three places where it must be correct, and none of them updates itself.

What IT-Grundschutz requires

The same pattern applies to information security. Basic requirement ISMS.1.A4 in the IT-Grundschutz Kompendium begins: the management of the institution must appoint an information security officer (ISO).

In the user catalogue of Grundschutz++, which is to replace the Kompendium, the role is found under GC.9.1.1.1, and the explanatory note there is clear: the role is to be filled in every institution, regardless of its type and size. To be filled means permanently, not once. A function whose holder has left is vacant, even if the certificate is still in the file.

Where it breaks in practice

• The change. Retirement, resignation, parental leave. Internally, word gets around; externally, the old status remains: with the supervisory authority, on the website, in the record of processing activities.
• The fixed term. An external officer is appointed for two years. The contract expires, nobody renews it, and the function has been empty for months without anyone noticing.
• The dual role. The ISO also takes on data protection, and later IT management too. In GC.9.1.1.3, Grundschutz++ requires measures against conflicts of interest when assigning roles. Whoever checks themselves does not check.

How isidaten handles this

In the officer and role register, every appointment is recorded with start, fixed term, deputy and revocation, and for the data protection officer additionally with the date of the notification to the supervisory authority and the date of publication. When an appointment is about to expire, isidaten reports it 90, 30 and 7 days in advance; a function the organisation has defined as mandatory and which has no current appointment is reported as vacant. The overview shows which current appointments have not yet been reported to the authority. The current DPO appointment is carried over into the master data from which privacy notices and the record of processing read, and incompatible dual roles are checked at the time of appointment.

The test question

Which name does your supervisory authority have as your data protection officer, and is that the person in office today?

If you have to look that up, the notification is probably older than the last change.

Sources

Regulation (EU) 2016/679 (GDPR), Article 37(7).

BSI IT-Grundschutz Kompendium, 2023 edition, module ISMS.1 Sicherheitsmanagement, requirement A4 (German).

BSI user catalogue Grundschutz++, as of 24.09.2026, requirements GC.9.1.1.1 (information security officer) and GC.9.1.1.3 (avoiding conflicts of interest) (German). Grundschutz++ is updated continuously; numbers and wording may still change until the methodology is published.