How do we appoint an employee responsible for data protection, and what goes into their duties?
Short answer
The company itself, as the controller, is responsible for data protection: it implements the measures and must be able to demonstrate that it complies with the GDPR (Article 5(2) and Article 24(1) GDPR). The GDPR does not require an internal responsible employee, but some duties have deadlines: a person's request is answered without undue delay and within one month at the latest (Article 12(3)), and a breach that is likely to result in a risk to people's rights and freedoms is notified to VDAI without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33(1)). So our recommendation: appoint one person and a deputy by an order, write down concrete tasks and plan the year. Below is ready-to-use text.
On this page
1.Is appointing such an employee mandatory?
No. The GDPR does not mention such a role. It sets what the company must do, not who inside the company does it. How to share the work is your decision.
Without an appointed person this work can go undone: a request lands in a shared inbox, nobody counts the month, and the manager hears about a breach a week later. An appointment costs one order.
Whether the obligation in Article 37 GDPR applies to your company is a separate question. The partner article on dat.lt covers it; the link is below.
2.What goes into the duties?
Below is a block you can put into a job description or an annex to the order. Each task shows which GDPR duty it helps to meet.
| Task | Why |
|---|---|
| Keeps and updates the record of processing activities when activities, systems or providers change | Unless the exemption in Article 30(5) GDPR applies to you, the record is mandatory; it is kept in writing, including in electronic form (Article 30(1) and 30(3)), and made available to VDAI on request (Article 30(4)) |
| Receives people's requests (access, rectification, erasure etc.), logs the date received and tracks the deadline | The answer is given without undue delay and within one month at the latest; where necessary, taking into account the complexity and number of requests, this may be extended by two further months – the person is told of the extension and the reasons for the delay within the first month (Article 12(3) GDPR) |
| Gathers the facts of a breach, fills in the breach register, drafts the notification to VDAI and is the contact point named in it | Without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33(1) GDPR); contact point (Article 33(3)(b)); documenting every breach (Article 33(5)) |
| Keeps a list of the providers that process data on the company's behalf and checks that each has a data processing agreement | Article 28(1) and 28(3) GDPR |
| Updates the notices to people: the privacy policy, notices to employees and candidates | Information to people, where data are collected from them (Article 13 GDPR) and where they are obtained from elsewhere, e.g. a candidate's CV via a job portal (Article 14 GDPR) |
| Before a new processing activity starts, checks whether an impact assessment is needed and tells the manager | Where the processing is likely to result in a high risk to people's rights and freedoms, the assessment is done before the processing starts (Article 35(1) GDPR) |
| Prepares short instructions for staff and organises training | The controller takes steps to ensure that staff process data only on its instructions (Article 32(4) GDPR) |
| Drafts answers to VDAI inquiries | Cooperation with the supervisory authority (Article 31 GDPR) |
| Once a year gives the manager a short report: what was done, what is left, which breaches occurred | Measures are reviewed and updated where necessary (Article 24(1) GDPR) |
In our suggested text, decisions – whether to notify VDAI, whether to start a new processing activity, whether to sign a contract – are taken by the manager. The responsible employee prepares, the manager decides.
3.What does the appointment order look like?
Our suggested text:
ORDER on appointing a coordinator of personal data protection tasks
[Date], No [ ]
1. I appoint [name, surname, position] as responsible for coordinating personal data protection tasks (the coordinator).
2. I assign to the coordinator the tasks listed in the annex.
3. When the coordinator is absent, the tasks are carried out by [name, surname, position].
4. The coordinator spends up to [ ] hours a month on these tasks.
5. All employees pass people's requests about their data and information about possible breaches to the coordinator without delay at [shared e-mail address].
6. Decisions on notifications to VDAI and to data subjects, on new processing activities and on contracts with processors are taken by [manager].[Manager's name, surname, signature]
Four things in this text matter most:
- A deputy. The one-month and 72-hour clocks do not stop during holidays.
- Time. Without hours set aside for this work, the tasks get pushed to next month, every month.
- A shared e-mail address. It stays when the person leaves; a personal address does not.
- The title. Choose a descriptive title, e.g. coordinator. Why this matters is explained in the partner article on dat.lt.
4.What does this employee not take over?
The controller's duties and responsibility under the GDPR. The controller is the company that determines the purposes and means of the processing (Article 4(7) GDPR), and it is the company that must implement the measures and be able to demonstrate compliance (Article 24(1)). Appointing an employee leaves that duty with the company.
So do not write in the order that the coordinator "is responsible for GDPR compliance". Write what they do.
5.A yearly task calendar
The standing tasks – requests and breaches – happen when they arise. Everything else is worth planning. Our suggested rhythm:
| When | Task |
|---|---|
| Ongoing | Logging requests and tracking deadlines; recording breaches in the register |
| January | Review of the record: any new processes, systems, providers |
| March | Provider list and check of data processing agreements |
| May | Review of the privacy policy and notices to people |
| September | Staff training and updated instructions; onboarding for newcomers |
| October | Breach drill: does everyone know whom to tell, do the templates work |
| November | Check of the deletion calendar: is each process's data being deleted at the frequency you set (how to set up a deletion calendar) |
| December | Annual report to the manager |
Pick the months to suit your own work rhythm. What matters is that each task has a date in the calendar, not just a place on a list.
6.What happens when the employee leaves?
Plan the handover in advance. Before leaving, the employee hands over to the deputy:
- open requests and their deadlines;
- the breach register and unfinished entries;
- where the record and the contracts are kept;
- access to the shared e-mail address.
Our recommendation: appoint the new coordinator by a new order no later than the day the previous one leaves.
7.What to do next
The responsible employee's first task can be the record. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities, which GDPR article that rests on, and which of your processes are risky. A record can also be ordered as a one-off procedure: €95 excl. VAT.
8.Frequently asked questions
Can these tasks be given to an outside company?
Yes. If the outside company will have access to the personal data you process while doing the work, it will usually act as a processor, and you need an agreement with it under Article 28(3) GDPR. The responsibility still stays with you.
Does the privacy policy have to name this employee?
No. Article 13(1)(a) GDPR requires the identity and contact details of the controller. Our recommendation: give a shared e-mail address, not a personal one.
We are a five-person company. Do we need this too?
The deadlines apply whatever your size. In a small company this can be one line in an existing employee's duties and a deputy's name, but not an empty space.
Does the responsible employee need a legal background?
The GDPR sets no such requirement for this employee. What matters more is that they know the company's processes and know where to turn when a question is harder.
9.Related questions
- GDPR training for staff: how to run and document it in one hour
- Breach register: what to record about every personal data breach
- Telling people about a personal data breach: a template and five steps
- Do we need a record of processing activities, and where do we start? (in Lithuanian)
The law and the risk: Data protection coordinator vs data protection officer – dat.lt
10.Legal sources
- The concept of controller – Article 4(7) GDPR.
- Accountability – Article 5(2) GDPR; controller's responsibility and review – Article 24(1).
- Deadline to answer a request – Article 12(3) GDPR.
- Information to people – Articles 13 and 14 GDPR; the controller's identity and contact details – Article 13(1)(a).
- Processors and the agreement – Article 28(1) and 28(3) GDPR.
- The record – Article 30(1) GDPR; in writing – Article 30(3); made available to VDAI – Article 30(4); exemption for organisations with fewer than 250 employees and its conditions – Article 30(5).
- Cooperation with VDAI – Article 31 GDPR.
- Steps so that staff process only on instructions – Article 32(4) GDPR.
- Breaches – Article 33(1) GDPR; contact point – Article 33(3)(b); documentation – Article 33(5).
- Impact assessment before processing, where a high risk is likely – Article 35(1) GDPR.
Legal texts checked on 2026-09-25: GDPR – official consolidated English text (02016R0679) with corrigenda. This text is general information and is not individual legal advice.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)