Who needs a data protection officer (DPO)
An officer is required for public-service processing, for core activities needing regular, systematic, large-scale monitoring, and for core activities processing specific (sensitive) personal data, or data on criminal offences, at large scale.
As of 21 Oct 2026
When a breach must be reported
Written notice to the people affected and to the agency within 3 × 24 hours.
As of 21 Oct 2026
Penalties
Administrative fines up to 2% of annual income or revenue relating to the violation.
As of 21 Oct 2026
Sources
- Law 27/2022 (Komdigi legal database)As of 21 Oct 2026
- Constitutional Court transcript, 27 Jul 2026 (PDF)As of 21 Oct 2026