23Second, the second sentence of Article 38(3) of the GDPR clearly applies without distinction both to the data protection officer who is a member of the staff of the controller or processor and to the person who fulfils the tasks on the basis of a service contract concluded with the latter, in accordance with Article 37(6) of the GDPR.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.