1. The Controller shall appoint one or more individuals to be responsible for the protection of Personal Data in any of the following cases:

1. Controller is a Public Entity that provides services involving Processing of Personal Data on a large scale.
2. Primary activities of the Controller consist of Processing operations that require regular and continuous monitoring of individuals on a large scale.
3. Core activities of the Controller consist of Processing sensitive Personal Data.

2. Subject to the requirements of paragraph (1) of this Article, the data protection officer may be an official, an employee or an external contractor of the Controller.