The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.