Do You Need One Person, or a Whole Department?

The straight answer

A DPO can be an internal employee or an external contractor. There’s no nationality requirement, and no mandatory certification. What is required is a written agreement covering scope and responsibilities.

So the answer isn’t building a department

One person who understands this, backed by a system that runs the records, requests, and incidents on their behalf, outperforms a full team stuck working in Excel. The system multiplies what one person can do. You don’t need to hire a whole team just to cover PDPL.

One detail worth knowing: once appointed, the DPO’s contact details have to be provided to SDAIA through the National Data Governance Platform, and updated whenever they change.