4 opening clauses allow member states to make regulations on the data protection officer:

Art. 37 IV: requirement of obligatory designation                   

Art. 38 V: secrecy or confidentiality rules laid down in Member State law                       

Art. 39 I a: informing and advising the controller/processor of their obligations pursuant to Member State data protection provisions     

Art. 39 I b: monitoring compliance with Member State data protection provisions