Questio n: What is the role of the DPO in a DPIA?

Under Article 39(1)(c) of GDPR, the DPO advises on the necessity of conducting a DPIA but does not

conduct it themselves. The controller is responsible for carrying out the DPIA.

Option B is correct because the DPO must determine whether a DPIA is required and provide

recommendations.

Option A is incorrect because conducting the DPIA is the responsibility of the controller, not the DPO.

Option C is incorrect because while the DPO can assist, DPIA documentation is the controller’s duty.

Option D is incorrect because DPOs advise but do not approve or eliminate all risks—risk

management remains the responsibility of the controller.

Reference:

GDPR Article 39(1)(c) (DPO advises on DPIA necessity)

Recital 97 (DPOs provide oversight, not execution)