Which of the following options is provided for in the GDPR and can be made by Member States?

Recital 10 of GDPR states:

“Regarding the processing of personal data for compliance with a legal obligation, for the

performance of a task carried out in the public interest or in the exercise of official authority vested

in the controller, Member

States should be allowed to maintain or introduce national provisions to further specify the

application of the rules of this Regulation.”

It also says: “This Regulation also provides a margin of manoeuvre for Member States to specify its

rules, including for the processing of special categories of personal data (‘sensitive data’).

However, this does not mean that Member States can approve a rule that goes against a GDPR

guideline. Note that these national provisions are measures to increase the effectiveness of the law.

Here is an example the case of Ireland where it was established that the DPO is responsible for data

breaches, something that is not provided for in the GDPR.