National Ordinance Personal Data Protection 

Pursuant to article 13 of the National Ordinance Personal Data Protection the responsible party shall execute appropriate technical and organizational measures to secure personal data against loss or any form of unlawful processing. These measures shall guarantee an appropriate level of security, taking account of the technical state of the art and the costs of execution, in view of the risks associated with that processing and the nature of the data to be protected. The measures shall be aimed partly at preventing unnecessary gathering and further processing of personal data. 

Besides the measures above, the National Ordinance Personal Data Protection does not contain any clauses on any type of registration, filings of documents to any public agency or having a mandatory data protection officer in place. 

GDPR 

The appointment of a data protection officer under the GDPR is only mandatory in three situations:

• When the organisation is a public authority or body;
• If the core activities require regular and systematic monitoring of data subjects on a large scale; or
• If the core activities involve large scale processing of special categories of personal data and data relating to criminal convictions.