A Data Protection Officer (DPO) is a person within or outside the organization who advises the data controller and its employees regarding the processing of personal data and monitors compliance with GDPR and other legislation in the field of data protection. DPO also has the obligation to cooperate with the supervisory authority. Authorities or elected assemblies (public bodies), organizations whose core business regularly, systematically and to a large extent monitor individuals or organizations whose core business in a large scale processes sensitive personal data or data on crime must have a DPO. Examples of activities that must have a DPO are hospitals, public transport, insurance companies and banks. Even if you do not have to have a DPO, the Swedish Privacy Protection Authority recommends that you have a DPO if you perform tasks of general interest or perform tasks that involve the exercise of public authority.