Yes. Article 37(2) GDPR allows a group of undertakings to appoint a single data protection officer provided they are easily accessible from each establishment. According to the guidelines of the European supervisory authorities, accessibility also means being able to communicate with data subjects and supervisory authorities in their language, which for a Slovak-Czech group means dealing with two authorities. Each company nevertheless remains a separate controller: it publishes the officer's contact details itself, notifies them to its own authority and must provide the conditions for the role to be performed.
A holding has a parent company, two operating companies in Slovakia and one in the Czech Republic. One of them must have a data protection officer, because it monitors customers systematically on a large scale; the others want one for safety’s sake. Appointing three or four different officers would be expensive and impractical. The GDPR anticipates this situation.
What the Regulation allows
The rule is brief:
A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.
The data protection officer may be an employee of one of the companies or may fulfil the role on the basis of a service contract (Article 37(6)). A group may therefore have a shared in-house specialist or an external provider. Slovak Act No. 18/2018 Coll. has its own rules on data protection officers in Section 44, but its second and third parts do not apply to processing governed directly by the GDPR (Section 3(2) of Act No. 18/2018 Coll.). For ordinary commercial companies, Article 37 GDPR is therefore decisive.
What “easily accessible” means
The Article 29 Working Party guidelines on data protection officers (WP243 rev.01), endorsed by the European Data Protection Board on 25 May 2018, interpret accessibility through the officer’s tasks. They are a contact point for data subjects and the supervisory authority, but also within the company, where they advise management and staff. They must be able to communicate efficiently with data subjects and to cooperate with supervisory authorities, and to do so in the language or languages used by those authorities and persons. Physical presence at each establishment is not required; a hotline or another secure communication channel is sufficient, provided it genuinely works.
For a group with companies in both Slovakia and the Czech Republic, it follows that the officer must be able to handle communication with both the Slovak and the Czech data protection authority and to answer customers and employees in both countries in their own language. They must also be familiar with the national rules that supplement the GDPR in each country.
Each company remains a controller
A shared data protection officer does not mean shared responsibility. Each company must publish the officer’s contact details and communicate them to the supervisory authority (Article 37(7)), involve them properly and in a timely manner in all data protection matters, and provide them with resources and access to processing operations (Article 38(1) and (2)). The officer must not receive any instructions regarding the performance of their tasks and reports directly to the highest management level (Article 38(3)). For a group, this means in practice that their tasks must be secured separately in each company, not only in the parent.
Watch out for conflicts of interest. The officer may fulfil other tasks, but these must not result in a conflict of interests (Article 38(6)). Under WP243, that excludes in particular positions that determine the purposes and means of processing, typically senior management and the heads of IT, HR or marketing. Within a group, this also extends to managers of the parent company who in fact decide on processing in the subsidiaries.
How to set this up
We recommend a single decision or contract appointing the officer by name for each company, defining the scope of their work in each of them and regulating who provides them with cooperation. Each company then notifies its own authority of the contact details and publishes them on its website. When a data protection officer is mandatory and what they do is explained on our data protection officer (DPO) as a service page; within that service we can take on the role for a group with both Slovak and Czech companies. How the authority calculates a fine for breach of duties is shown in how the authority calculates a GDPR fine.
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
