The Data Protection Officer may be an employee of a data controller or engaged by a service contract.