A data protection officer (DPO) is the independent expert role defined by the GDPR that advises an organization on its data protection obligations, monitors its compliance and acts as the contact point for supervisory authorities and data subjects. The role is set out in Articles 37 to 39 of the GDPR, and in many organizations its appointment is a legal requirement rather than a choice.
The DPO is not the person responsible for compliance. Accountability stays with the controller or processor, while the DPO is a protected internal advisor and monitor who must be able to say uncomfortable things to senior management without fear of consequences.
When the GDPR requires a data protection officer
Article 37 makes a DPO mandatory in three situations, which apply to both controllers and processors. Outside them, appointment is voluntary, but an organization that voluntarily names a DPO must then meet all the same requirements for that role.
| Criterion | Meaning | Typical examples |
|---|---|---|
| Public authority or body | Any public body except courts acting judicially | Ministries, municipalities, public hospitals, schools |
| Large-scale systematic monitoring | Core activities regularly track individuals at scale | Behavioral advertising, telecom operators, loyalty programs |
| Large-scale special category data | Core activities process health, biometric or similar data, or criminal data | Hospitals, health insurers, genetic testing firms |
Two qualifiers decide most borderline cases. Core activities are the main operations that achieve the organization’s purpose, not supporting functions such as payroll. Large scale depends on the number of people, the volume and range of data, the duration and the geographic extent; the GDPR sets no numeric threshold.
National law can extend the obligation. Germany, for example, requires a DPO when at least 20 people regularly process personal data by automated means, regardless of the GDPR criteria. A group of companies may appoint a single DPO if that person is easily accessible from each establishment.
Tasks the GDPR assigns to the DPO
Article 39 lists minimum tasks, which the DPO performs with due regard to the risk of processing operations. In practice, the DPO concentrates effort where the potential harm to individuals is greatest.
| Task | What it involves in practice | Typical outputs |
|---|---|---|
| Inform and advise | Explain obligations to management and staff | Opinions, policies, guidance notes |
| Monitor compliance | Check policies, responsibilities, training and audits | Audit reports, compliance dashboards |
| Advise on DPIAs | Comment on whether and how to run a DPIA | Written DPIA opinions |
| Cooperate with the authority | Respond to and work with the supervisory authority | Correspondence, consultation records |
| Act as contact point | Handle authority and data subject contacts | Published contact details, request handling |
Many DPOs also maintain the records of processing activities, coordinate data breach notification and review contracts with processors. These are common additions, but the legal duty to carry them out still belongs to the controller.
Independence, position and protection
Article 38 gives the DPO a protected position so that advice and monitoring remain credible. These guarantees are what distinguish a DPO from an ordinary compliance employee.
- Early involvement: the DPO must be involved properly and in a timely manner in all data protection issues.
- Resources: the organization must provide time, budget, staff, training and access to processing operations.
- No instructions regarding how the DPO performs the tasks, and no dismissal or penalty for performing them.
- Direct reporting line to the highest management level.
- Confidentiality obligations regarding the performance of the tasks.
- No conflict of interest with other duties the DPO holds.
Conflict of interest is the most frequent problem in practice. A person who determines the purposes and means of processing cannot objectively monitor them, so roles such as chief executive, head of IT, head of marketing or head of human resources are generally incompatible with the DPO function. The assessment is case by case, and the Court of Justice of the EU has confirmed that national courts must examine the specific facts.
How the DPO differs from related roles
The DPO is often confused with other privacy and security roles. The comparison below shows the different legal basis and purpose of each.
| Role | Legal basis | Main purpose |
|---|---|---|
| Data protection officer | GDPR Articles 37-39 | Independent advice and compliance monitoring |
| Controller | GDPR Article 4(7) and Article 24 | Decides purposes and means; bears accountability |
| EU representative | GDPR Article 27 | Local presence for non-EU organizations |
| Chief information security officer | Organizational choice | Protects systems and information assets |
| Privacy counsel | Organizational choice | Represents the organization’s legal interests |
The difference between a DPO and privacy counsel is subtle but important. Counsel advocates for the organization, while the DPO must remain objective and may report findings that the organization would prefer not to hear. The EU representative role is also separate, and one person should not normally combine it with the DPO role.
Appointing a DPO in practice
The GDPR requires expert knowledge of data protection law and practice, chosen in proportion to the complexity of the processing. It allows both internal and external DPOs, appointed under an employment contract or a service contract.
| Aspect | Internal DPO | External DPO |
|---|---|---|
| Business knowledge | Deep understanding of processes | Must learn the organization first |
| Independence risk | Higher, through other internal duties | Lower, but depends on contract terms |
| Availability | Present daily | Limited by contracted hours |
| Cost profile | Salary and training | Fees, often scalable |
The organization must publish the DPO’s contact details and communicate them to the supervisory authority. Failing to appoint a required DPO, or undermining the role, can lead to fines of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. The DPO is not personally liable for the organization’s non-compliance under the GDPR.
Understanding it simply
A data protection officer is an in-house referee for personal data. The organization makes the decisions about how it uses customer and employee information, and the officer checks that those decisions follow the law and tells management when they do not.
The law protects this person so the job can be done honestly. The officer cannot be fired for giving unwelcome advice and reports directly to top management. People whose data is processed can also contact the officer directly with questions or complaints.
Applied in practice
A regional health insurer with about 400,000 members processes health data at large scale as a core activity, so the GDPR requires it to appoint a DPO. The insurer first proposes its head of IT for the role, but its legal team concludes that the head of IT decides how member data is processed and therefore has a clear conflict of interest.
The insurer instead appoints an experienced privacy lawyer as an internal DPO reporting to the board, with two analysts on the team. The DPO publishes a contact address, registers the details with the supervisory authority and sets up a yearly audit plan covering claims processing, the member app and marketing.
When the marketing department plans to use claims data for targeted wellness offers, the DPO advises that a DPIA is required and that the existing legal basis does not cover the new purpose. The project is redesigned around explicit opt-in consent. The outcome shows the role working as intended: independent advice changed a decision before harm occurred.