EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 37

Analysis in our dossiers
Breach reporting and practical compliance

Text

Article 37 GDPR as printed in the Council text of 3 September 2026

Designation of the data protection officer

Source Council, 3 September 2026. Article 37: ST 12535/26, page 121 · Omnibus Article 3, point 9a · exact text page

Scope This text prints Article 37(7) only.

Back to law in force

The 3 September Council text marks this proposed change as dropped and supplies no replacement wording. On its own, that deletes nothing from the law in force.

How each paragraph has changed

Show the statuses
What each text would do to the law in force
Paragraph Commission19 Nov 2025Council21 May 2026Council10 Jun 2026Council18 Jun 2026Council3 Sep 2026Council2 Oct 2026Council22 Oct 2026 Parliamentamendments
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
7Paragraph 7 No change Unchanged Amends , changed since the proposal Changed Amends Unchanged Amends Unchanged No change , back to the law in force since 18 Jun Back to law in force No change Unchanged No change Unchanged 1
Provisions only Parliament would add or change2 units Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text Not in the law in force or this text In neither text 2

Each text against the law in force: ~Amends amends the law in force=No change leaves the law in force as it is— neither the law in force nor the text has it changed from the text before

Each text against the text before it: ~Changed wording changed↩Back to law in force drops the text before’s change to the law in force=Unchanged same as the text before— in neither text

What each text does

  1. 19 Nov 2025 Commission proposalCOM(2025) 837 No change Leaves this article as in the law in force.
  2. 21 May 2026 Council textST 9547/26 Changed Changes paragraph 7.ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others. Article 37 in this text
  3. 10 Jun 2026 Council textST 10426/26 Unchanged Same as the text before. Article 37 in this text
  4. 18 Jun 2026 Council textST 10677/26 Unchanged Same as the text before. Article 37 in this text
  5. 27 Jul 2026 ITRE–LIBE amendments 1053–1260 to the draft reportCJ72-AM-791073 3 amendments to this article. Amendments in this document
  6. 3 Sep 2026 Council textST 12535/26 Back to law in force Takes paragraph 7 back to the law in force. Article 37 in this text
  7. 2 Oct 2026 Council textST 13886/26 Unchanged Same as the text before.Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.
  8. 22 Oct 2026 Council textST 14756/26 Unchanged Same as the text before.

Paragraph 7

Changed by the Council on 21 May · back to the law in force on 3 September

Parliament amendments 1

1 would add wording to paragraph 7.

  1. 1237 Addition Angelika Niebler +1EPP · ITRE–LIBE “The controller or the processor shall publish the contact details of the data protection officer.”

    9a. Article 37, paragraph 7, is amended as follows

    The controller or the processor shall publish the contact details of the data protection officer.

    Tabled by
    Angelika Niebler, Monika Hohlmeier
    Group
    EPP
    Targets
    GDPR Article 37(7)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 37 – paragraph 7

Provisions only Parliament amendments would add or change

2 amendments on 2 units the Commission proposal leaves unchanged

Paragraph 2a (new)New

  1. 1239 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Microenterprises, small and medium-sized enterprises within the meaning of Recommendation 2003/361/EC, and small mid-cap enterprises may jointly…” numbered 2a

    9b.In Article 37, paragraphs 2a and 4a are inserted:

    2a.Microenterprises, small and medium-sized enterprises within the meaning of Recommendation 2003/361/EC, and small mid-cap enterprises may jointly designate a single data protection officer, whether or not they are partner or linked enterprises, provided that the data protection officer is easily accessible from each of them and is able to perform his or her tasks effectively in respect of each participating enterprise, taking into account the nature, scope, context and purposes of their respective processing operations. The participating enterprises shall specify, in a written arrangement, the allocation of responsibilities and the resources made available to the shared data protection officer.';

    4a.Member States may provide that a public body designated for that purpose makes available data protection officers acting for a pool of microenterprises, small and medium-sized enterprises or small mid-cap enterprises. A data protection officer made available under this paragraph shall perform the tasks referred to in Article 39 independently, in accordance with Article 38, and shall not receive instructions regarding the exercise of those tasks. This paragraph shall not apply to the supervisory authorities referred to in Article 51, so as to avoid any conflict of interest.';

    Justification

    The cost of a dedicated data protection officer is prohibitive for small structures. The amendment allows micro, small and medium-sized enterprises and small mid-caps which are not related undertakings to designate a single data protection officer jointly, provided that the officer is easily accessible from each establishment and that the conditions of independence and absence of conflict of interest are met in respect of each controller concerned. Pooling reduces compliance costs without lowering the level of protection.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 37 – paragraphs 2a and 4a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 b (new) / Regulation (EU) 2016/679 / Article 37 – paragraphs 2a and 4a (new)

Paragraph 4Not amended by the Commission

  1. 1238 Alternative Axel VossEPP · ITRE–LIBE “In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of…”

    9a. In Article 37, paragraph 4 is replaced by the following:

    4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors."

    Justification

    DPO Package #2: The amendment strengthens accountability by recognising DPOs as practical governance safeguards and first points of contact for complaints. DPOs already advise controllers and processors, monitor compliance and support data subjects; giving them an explicit complaint-handling role makes resolution faster, less bureaucratic and closer to the facts. Voluntary or shared DPOs are encouraged. Supervisory authorities remain available where the complaint is not addressed or not fully remedied within one month.

    Tabled by
    Axel Voss
    Group
    EPP
    Targets
    GDPR Article 37 – paragraph 4
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 37 – paragraph 4