---
title: "Recital 97 GDPR"
canonical: "https://dposchool.com/gdpr/recital/97"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#rct_97"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Recitals

# Recital 97

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Official text

Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is carried out by a controller whose core activities consist of processing operations that require regular and systematic monitoring of the data subjects on a large scale, or where the core activities of the controller or the processor consist of processing on a large scale of special categories of personal data and data relating to criminal convictions and offences, a person with expert knowledge of data protection law and practices should assist the controller or processor to monitor internal compliance with this Regulation. In the private sector, the core activities of a controller relate to its primary activities and do not relate to the processing of personal data as ancillary activities. The necessary level of expert knowledge should be determined in particular according to the data processing operations carried out and the protection required for the personal data processed by the controller or the processor. Such data protection officers, whether or not they are an employee of the controller, should be in a position to perform their duties and tasks in an independent manner.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Recital 97 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#rct_97)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related articles

This list is under review.

- [Article 37: Designation of the data protection officer](https://dposchool.com/gdpr/article/37)
- [Article 38: Position of the data protection officer](https://dposchool.com/gdpr/article/38)
- [Article 39: Tasks of the data protection officer](https://dposchool.com/gdpr/article/39)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Recitals](https://dposchool.com/gdpr/recitals) / Recital 97

Previous: [Recital 96 GDPR](https://dposchool.com/gdpr/recital/96)

Next: [Recital 98 GDPR](https://dposchool.com/gdpr/recital/98)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents