What is a data protection officer?

Where the DPO sits

A data protection officer is the person a company names under the GDPR to watch its handling of personal data from the inside. Recital 97 puts it in one line: someone with expert knowledge of data protection law and practice who helps the company monitor its own compliance. The regulation then fixes who the DPO answers to and who can reach the DPO. Drawn as lines on a page, the role looks like this.

Two things follow from the drawing. The DPO is an adviser and a watcher, not the person who runs your privacy work: the duties to comply stay with the company. And the line to the top is short on purpose, so that advice the business would rather not hear still reaches the people who decide.

Must you appoint one?

The GDPR sets no headcount and no revenue line for a DPO. It names three cases, and a company in none of them has no duty under the regulation itself. Most small firms land there. The test applies to controllers and processors alike.

The fourth question matters more than its place suggests. Art. 37(4) lets EU or national law require a DPO in other cases. Germany is the best-known example: its federal data protection act asks for one where a company regularly has at least 20 people constantly working on automated processing of personal data, and regardless of headcount where it carries out processing that needs an impact assessment, or processes data commercially for transfer or for market or opinion research (BDSG § 38). Check the law of each EU country where you have an establishment.

Your processor may need one when you do not

The test runs on each organisation’s own core activities. The WP29’s example is a family firm selling household appliances in a single town, which uses a processor for web analytics and targeted advertising. The family firm processes too little to be on a large scale and needs no DPO. The processor, doing the same work for many such clients, is processing on a large scale and must appoint one. Where both are caught, the two DPOs are expected to cooperate. Your own processors are listed in your data inventory and record of processing; it is worth noting which of them name a DPO in their terms.

The three phrases that decide it

Cases (b) and (c) turn on words the GDPR does not define. The Article 29 Working Party read each of them in its DPO guidelines (WP243 rev.01), and the EDPB endorsed those guidelines on 25 May 2018, the day the GDPR began to apply. Their examples are the nearest thing to a scale the law has.

The WP29 is candid about the middle: its examples sit at the two ends of the scale, with a large grey zone in between. A ten-person clinic, a regional loyalty app or an HR platform for a few hundred employers is a judgment call, and the written analysis is where that judgment lives.

What the DPO does, and what stays with you

Art. 39(1) lists the DPO’s tasks as a minimum, so a company can add more. The list is short, and most disputes about the role come from reading it as a list of jobs the DPO does instead of you. Each line has two sides.

• Art. 39(1)(a)

  Inform and advise

  The DPO

  Tells the company, and the staff who process data, what the GDPR and other data protection law require of them.

  Stays with you

  Decide what to do with the advice. Where you do not follow it, the WP29 calls it good practice to write down why.

• Art. 39(1)(b)

  Monitor compliance

  The DPO

  Finds the processing, checks it against the law and your own policies, recommends fixes, and runs training and the related audits.

  Stays with you

  Comply, and be able to show it (Art. 24(1)). The WP29 is explicit: compliance is the controller's responsibility, and the DPO is not personally liable for a failure.

• Art. 39(1)(c)

  Impact assessments

  The DPO

  Advises where asked, from whether to run one to whether its conclusions hold up, and monitors how it is carried out.

  Stays with you

  Carry out the assessment (Art. 35(1)) and seek the DPO’s advice (Art. 35(2)). If you overrule it, say why in the DPIA itself. The DPIA template has room for it.

• Art. 39(1)(d)–(e)

  The regulator's contact

  The DPO

  Cooperates with the supervisory authority and is its contact point, including on prior consultation (Art. 36). May consult it on any other matter.

  Stays with you

  Answer for the processing. Being the contact point does not make the DPO the one who carries the duties.

• Art. 38(4)

  People's requests

  The DPO

  Is a point of contact for anyone with a question about their data or their rights.

  Stays with you

  Answer within one month of receipt, extendable by two further months where needed (Art. 12(3)). What a DSAR is covers the reply itself, and the DSAR response template drafts it.

• Art. 30(1)

  The record of processing

  The DPO

  Not a listed task. The WP29 notes that many DPOs keep the inventory in practice, and you may assign it.

  Stays with you

  Keep it: the duty is the controller’s or processor’s. Data mapping is how the record gets built.

Art. 39(2) adds one working rule: the DPO weighs the risk of each processing operation. In the WP29’s reading that means spending the most time where the risk is highest, without dropping the rest.

Independence, and who cannot hold the job

That sentence is the core of the role, and the GDPR backs it with three more guarantees. Read with the WP29’s guidelines, the four look like this in practice.

The conflict-of-interests rule

Art. 38(6) lets a DPO carry other duties, as long as none of them creates a conflict of interests. The test the WP29 gives is simple: the DPO cannot hold a position that decides why and how personal data is processed. As a rule of thumb it names the chief executive, the chief operating, financial and medical officers, and the heads of marketing, HR and IT, plus any lower role that sets those purposes and means. An external DPO asked to represent you in court on a data protection case is conflicted too.

At a 30-person firm that rules out most of the obvious internal picks, which is why the service contract in the next section matters to small companies.

A staff member or a service contract

Either way the bar is the same. Art. 37(5) asks for professional qualities and, in particular, expert knowledge of data protection law and practice. The WP29 scales that to the processing: more sensitive, complex or voluminous data, or regular transfers outside the EU, call for a more expert DPO. The rules then land a little differently on each route.

If you take the contract route, our outsourced DPO services comparison reads firms that sell the role against Arts 37 to 39, row by row, from each firm’s own service pages.

One DPO for a group

A group of companies may share a single DPO, provided the DPO is easily accessible from each establishment (Art. 37(2)). The WP29 reads accessible broadly: reachable by staff, by the people whose data is held and by each regulator concerned, in the languages they use.

Where the DPO's details go

Art. 37(7) has two halves: publish the DPO’s contact details, and send them to the supervisory authority. The aim, in the WP29’s words, is that people and the regulator can reach the DPO directly, without going through another part of the company. Three other articles then ask for the same details.

• Your website and privacy noticeContact details: a postal address, a dedicated phone line or a dedicated email address. The name is optional.Arts 37(7), 13(1)(b), 14(1)(b)
• Your supervisory authorityThe contact details, and in the WP29's view the name, so the DPO can act as the authority's contact point.Arts 37(7), 39(1)(e)
• Your record of processingThe DPO's name and contact details, beside the controller's own.Art. 30(1)(a)
• A breach notificationThe name and contact details of the DPO, or of another contact point.Art. 33(3)(b)
• Inside the companyName and contact details on the intranet, the phone list or the organisation chart. Good practice, not a duty.WP243 s. 2.6

A dedicated address matters more than it looks. The DPO is bound by secrecy or confidentiality about the work (Art. 38(5)), and the WP29 notes that employees may hold back a complaint if they cannot count on it staying confidential. A shared inbox the sales team reads does not fit that. A notice line that does the job reads like this:

The privacy policy checklist asks for this line once you tick that a DPO is appointed, so a missing contact shows up when you check the notice.

If you need no DPO, write down why

For most small firms this is the whole of their DPO work: a short, dated note that walks the three cases, checks national law and says who reviewed it. The WP29 counts it as part of your accountability documentation and expects it to be updated when you start new activities or services. Fill in the template below for your own company, then copy or print it and file it with your GDPR checklist record.

RECORD: WHETHER WE MUST APPOINT A DATA PROTECTION OFFICER (GDPR ART. 37)
Company: Harbour & Pine Studio Ltd, a 30-person design agency
Date: 23 Oct 2026

Processing activities reviewed:
  - Client contacts and project files
  - Staff records and payroll
  - Website analytics, aggregate, no ad profiling
  - A monthly newsletter to client contacts

Art. 37(1)(a), public authority or body: No. A private company with no public task.
Art. 37(1)(b), large-scale regular and systematic monitoring as a core activity: No. We do not track or profile people as part of what we sell. Analytics and the newsletter support the business and are ancillary.
Art. 37(1)(c), large-scale special-category or criminal data as a core activity: No. The only health data is staff sick-leave notes, handled as HR administration and not on a large scale.
Art. 37(4), national law: [Name the national law you checked for each EU establishment, the rule you read and where you read it.]

Conclusion: No DPO is required under Art. 37(1). We have not appointed one voluntarily. Privacy questions go to our operations lead, whose title is not data protection officer.
Review: Before we launch any new service or activity that processes personal data, and at our yearly compliance review.
Approved by: Managing director

Prepared with the WP29 Guidelines on DPOs (WP243 rev.01), section 2.1. Information, not legal advice.

The UK GDPR version

The UK kept Arts 37 to 39 in its own copy of the regulation, the UK GDPR, and the role is the same: three cases, the same independence, the same tasks. The text has drifted in a few places since 2020, and two of them matter to a small firm. Outside the three cases a DPO is voluntary, with no national add-on to look up. And the regulator the details go to is now the Information Commission.

The two tests run separately. A company established in both the EU and the UK, or caught by both laws from outside, answers each one on its own text, and checks the UK wording on legislation.gov.uk rather than in an older summary: the UK text was last amended on 30 September 2026.

Questions