The controller must grant the data protection officer:
- access to the required resources;
- access to all information, documents, records of processing activities and personal data that the officer requires to fulfil his or her tasks;
- the right to notify the highest management or governing body in important cases.