NIST Privacy Framework, Govern-PGV.PO-P3

Designate a data protection officer if the processing is carried out by a public authority or body, other than the courts and the public prosecutor acting in their procedural capacity, if your core activities require regular and systematic monitoring of data subjects on a large scale, or if your core activities consist of large-scale processing of the special categories of data in Article 8 or of data on criminal convictions and offences in Article 11 (Article 30(1)).

Designate the officer on the basis of professional qualities and expert knowledge of data protection law and practice, and communicate the officer's contact details to the CNPD (Article 30(4) and (6)).

A data controller and processor must each appoint a personal data protection officer and notify the Ministry of Post and Telecommunications of that appointment within 30 working days, maintain records of processing activities, and, if located outside Cambodia, appoint a local representative.

Designate a data protection officer to keep the processing register, review new processing before it starts, consult the agency in case of doubt, and handle data subject requests; only a person residing in the Central African Republic with the necessary qualifications may hold the role, and the agency must be told before the officer is removed.

Appoint a data protection officer where your processing is non-occasional, high-risk, or touches special-category or criminal-record data, and keep a written record of your processing activities available to the Data Protection Authority.

Designate a data protection delegate where the law requires one, and let the delegate carry out the functions article 49 sets.

Appoint a Data Protection Officer, have the officer registered in the Center's register, and let the officer carry out the duties articles 9 and 13 set.

Register with the Ethiopian Communications Authority before processing personal data, and appoint a data protection officer where the Proclamation requires one.

Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, and appoint a Data Protection Officer where your core activities involve large scale monitoring or large scale special category processing.

Designate a data protection officer, notify the APDPVP of the designation, and give the officer the office, resources and independence to advise you, monitor compliance, and liaise with the APDPVP, where you are a public authority, carry out large-scale systematic monitoring, or process sensitive or criminal-offence data at scale.

Designate a data protection officer if you are a public authority, or if you engage in large-scale monitoring or large-scale processing of sensitive data.

An app that operates a database of the personal data of individuals in Israel above the small-collection thresholds must register with, or separately notify, the Privacy Protection Authority under Art. 8A, and must name a Data Protection Officer where the Act requires one.

Appoint a qualified data protection officer with no conflict of interest if you are a public authority, process sensitive personal data or data relating to criminal convictions, or process personal data on a large scale, and give the Commissioner that officer's name and contact information.

An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.

Appoint a Data Protection Officer if you are a public authority, or if your core activities require regular and systematic large-scale monitoring of data subjects or large-scale processing of special categories of data or criminal-offence data, and publish that officer's contact details to the Agency.

An app that collects, uses, or discloses the personal data of individuals in Kyrgyzstan must process it lawfully, fairly, and transparently, limit use to the stated purpose, minimize what is collected, keep it accurate, and limit retention to the processing purpose. An organization with more than ten employees must designate a personal-data-responsible person and provide staff training.

Remain responsible for personal information transferred to a third party for processing, domestically or internationally, use contractual or other reasonable means to provide a comparable level of protection, and designate an individual accountable for compliance, whose identity is made known to a data subject on request.

Designate a data protection officer to keep the processing register current, advise on new processing before it starts, take in data subjects' requests and complaints, and escalate an uncorrected breach to the CMIL.

Designate a data protection officer where the law requires one, give them the position article 38 prescribes, and let them carry out the tasks article 39 lists.

Designate a data protection officer wherever you are a public body, your core activities require large scale regular and systematic monitoring, or your core activities involve large scale processing of sensitive or criminal record data, and let that officer report to top management free of instructions.

Designate one or more individuals responsible for compliance with this chapter's data protection principles.

Appoint a data-protection correspondent within your organization and notify the appointment to the HAPDP; a public-sector controller appoints a focal point instead.

Designate a Data Protection Officer as section 32 of the Act mandates, give the officer the position the Directive prescribes, and have the officer prepare semi-annual data protection reports.

Appoint a data protection officer as article 18 provides.

Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.

Carry out a data protection impact assessment before a type of processing likely to create a high risk to the rights and freedoms of natural persons, and designate a data protection officer where article 83 requires one.

Register with the supervisory authority as a data controller or data processor before processing personal data, and designate a data protection officer where article 40 requires one.

Designate a data protection officer where the law requires one, give them the position article 39 prescribes, and let them carry out the tasks article 40 lists.

Designate a data protection officer where a government body processes personal data, where core activities require regular and systematic large-scale monitoring, or where core activities involve large-scale processing of special categories of personal data, and give that officer the independence and resources Article 58 requires.

As a data controller of major importance, register with the Authority within six months of qualifying, and designate a data protection officer.

Register your information officer with the Information Regulator before that officer takes up duties under the Act.

Follow LOPDGDD Titulo V's controller and processor obligations, including its DPO qualification rule at Article 35.

Appoint a data protection officer to advise you and your staff on this law's duties, liaise with the Commissioner, and act as the contact point for data subjects exercising their rights.

Take the technical and organizational security measures the Authority approves to protect personal data against unauthorized or unlawful processing and against loss or damage, and appoint a data protection officer, registered with the Authority, if you are a legal person.

Where you appoint a data protection correspondent to qualify for the formality exemption, notify the appointment to the Instance and have the correspondent advise on compliance, cooperate with the Instance, and keep an accessible list of the processing you carry out.

If a public entity, a wholly or partly state-owned entity, or a private entity that processes sensitive data as a main line of business or processes large volumes of data, designate a data-protection officer with technical autonomy.

Where this Regulation binds your processing, identify the Data Controller as the Governorate, represented by the General Secretary, and put in place organizational and technical security measures suitable to protect the personal data you process. Appoint a Representative in writing where the Regulation calls for one, and record the activity in the Register of treatment activities.

Appoint a data protection officer in accordance with the Commissioner's guidelines.

Notify the Authority of the appointment of your data protection officer, and have the officer ensure compliance, handle requests made to you and work with the Authority.