One of the most common GDPR questions I receive from Horizon Europe project coordinators is: "Do we need to appoint a Data Protection Officer?" The answer is simpler than many people think—not every organisation is required to have one.

Under the General Data Protection Regulation (GDPR), a Data Protection Officer (DPO) must be appointed when: 

• the organisation is a public authority or public body (with some exceptions - e.g. a court is processing personal data in the exercise of its judicial capacity);
• its core activities involve large-scale, regular and systematic monitoring of individuals; or
• its core activities involve large-scale processing of special categories of personal data (such as health or genetic data) or criminal offence data.

Many universities, hospitals and public research institutions already have an appointed DPO. In that case, Horizon Europe projects usually rely on the institution's existing DPO rather than appointing a separate one for the project.

But, what counts as a public body? Whether an organisation qualifies as a public authority or body depends primarily on the applicable national law. Universities and research institutions therefore need to check their legal status rather than relying solely on their funding model.

From my experience, many project coordinators confuse the roles of an Ethics Advisor and a Data Protection Officer.

Having an Ethics Advisor is not the same as having a DPO.

A DPO focuses specifically on compliance with data protection law, while an Ethics Advisor considers broader ethical issues such as informed consent, research integrity, vulnerable participants, and responsible research practices.

If your project processes personal data, especially sensitive data, it is always worth checking whether your organisation already has a DPO and involving them early in the project. Early advice can prevent GDPR compliance issues and make ethics reviews much smoother.