Pursuant to Article 37(6) of the GDPR, the DPO may be either an employee of the controller or processor or a person not being an employee of the aforementioned entities (outsourcing).
