Data Protection Officer (DPO)

When a DPO is mandatory

The GDPR does not require every organization to appoint a DPO. The obligation is triggered in three defined circumstances:

• Public authorities and bodies — any processing carried out by a public authority or body, except courts acting in their judicial capacity, requires a DPO.
• Large-scale regular and systematic monitoring — where the core activities of the organization consist of processing operations that, by their nature, require regular and systematic monitoring of data subjects on a large scale.
• Large-scale special-category processing — where the core activities consist of large-scale processing of special categories of data (such as health, biometric, or genetic data) or data relating to criminal convictions and offenses.

The phrase core activities is decisive: the processing must be central to what the organization does, not an ancillary support function such as ordinary HR or payroll administration. Where the obligation does not apply, an organization may still appoint a DPO voluntarily — and once appointed, the same statutory requirements for independence, position, and tasks apply.

The DPO's tasks

The role of the DPO is set out in GDPR Articles 37 to 39, which govern the designation, position, and tasks of the office. The DPO's core responsibilities are:

Inform and advise

The DPO informs and advises the organization and its employees who carry out processing of their obligations under the GDPR and other data protection provisions. This is an advisory function — the DPO is a source of expertise, not the party that decides how data is processed.

Monitor compliance

The DPO monitors compliance with the GDPR, with other applicable data protection law, and with the organization's own internal policies. This includes assigning responsibilities, raising awareness, training staff involved in processing operations, and conducting related audits.

Advise on DPIAs

Where a Data Protection Impact Assessment (DPIA) is carried out, the DPO provides advice when requested and monitors its performance. DPIAs are required for processing likely to result in a high risk to individuals — a category that increasingly includes automated decision-making and AI systems.

Cooperate with the supervisory authority

The DPO cooperates with the supervisory authority and acts as the contact point for it on issues relating to processing, including prior consultation. The DPO is also the point of contact for data subjects on questions about how their personal data is processed and how they may exercise their rights.

Independence and position

What distinguishes the DPO from an ordinary compliance manager is the statutory protection of independence. The GDPR requires that the DPO:

• Reports to the highest management level, so that data protection concerns reach the people who actually set strategy and allocate resources.
• Receives no instructions regarding the exercise of their tasks — management cannot direct the substance of the DPO's advice or findings.
• Is not dismissed or penalized for performing their duties, protecting the role from retaliation when its conclusions are unwelcome.
• Operates without a conflict of interest, meaning the DPO should not also hold a position that involves determining the purposes and means of processing (for example, a senior IT or marketing decision-maker).

The role can be filled internally by an employee or outsourced to an external provider on a service contract. Either way, the organization must give the DPO adequate resources, access to processing operations, and the support needed to maintain expertise. The DPO is bound by confidentiality in carrying out the role.

DPO vs CISO

The DPO is frequently confused with the Chief Information Security Officer (CISO). They are complementary but distinct: the CISO owns the security of information and systems, while the DPO oversees the lawful and fair processing of personal data. Crucially, the CISO makes operational decisions about how data is protected, whereas the DPO must remain independent of those decisions in order to assess them objectively.

The independence requirement is why the same person usually cannot hold both roles: a CISO who decides how personal data is secured cannot also be the independent party who evaluates whether that processing is compliant.

The DPO's expanding role in AI governance

AI has materially enlarged what the DPO must oversee. Personal data now flows into AI tools and out of them in ways that traditional compliance reviews were never designed to capture.

When employees paste customer records into a chatbot, when an AI assistant summarizes a document containing special-category data, or when an autonomous agent reads an internal record and sends it to an external service, personal data is being processed — often without a record, a lawful basis assessment, or a DPIA. This is shadow AI: AI usage that occurs outside sanctioned tools and outside the DPO's visibility.

For the DPO, three developments are significant:

• Automated decision-making — processing that produces legal or similarly significant effects on individuals demands closer scrutiny and frequently a DPIA, on which the DPO must advise.
• New, high-volume data flows — AI prompts and tool calls are a fast-growing channel through which personal data leaves the organization, yet they rarely appear in records of processing activities.
• Accountability evidence — the DPO's monitoring duty depends on being able to demonstrate, not merely assert, how personal data is handled. Without an audit trail of AI interactions, that evidence does not exist.

The DPO cannot oversee what the organization cannot see. As AI becomes a primary route for personal data to enter and leave the business, the office's effectiveness increasingly depends on having visibility and control at the AI interaction layer.