Why Every Organisation Needs a Data Protection Officer

What is a Data Protection Officer?

A Data Protection Officer (DPO) is a specialized expert responsible for ensuring an organization’s compliance with data protection regulations, primarily the GDPR.

According to the GDPR the controller and the processor must involve the DPO properly and in a timely manner, in all issues which relate to the protection of personal data.

In summary, according to GDPR, the tasks of the DPO are, at least, the following ones:

• to inform and advise the organisation and its employees on data protection obligations.
• to monitor the organisation compliance with the GDPR
• to assign responsibilities, to raise awareness and train staff involved in processing operations, including audit
• to provide advice on requests concerning the data protection impact assessment (DPIA) and monitor its performance
• to act as a contact point for the data protection authority (DPA) on issues related to the processing and to cooperate with that DPA for that matter.

To sum up, the controller and processor must actively involve the data protection officer in all matters related to personal data protection, including data breaches, and do so in a proper and timely manner.

In practice, the data controller or processor often assigns the data protection officer the task of maintaining the record of processing operations.

When to appoint a DPO?

Altogether, the appointment of a DPO is mandatory in the following three cases:

• the organisation is a public authority that carries out the processing of personal data.
• the organisation’s core activities consist in regular and systematic monitoring of individuals on a large scale, for example geolocation via a mobile application, or surveillance of shopping centres and public spaces through CCTV.
• the organisation’s core activities consist in large-scale processing of special categories of data or personal data relating to criminal convictions and offences.  

The notions of core activities, regular and systematic monitoring and large-scale are crucial in determining whether an organisation should appoint a DPO. Article 29 Data Protection Working Party defined these notions in a dedicated guideline.

First, core activities mean primary activities and do not relate to the processing of personal data as ancillary activities.

Next, different factors determine large-scale processing, such as the number of data subjects involved, either as a specific number or a proportion of the relevant population, the volume and variety of data items processed, the duration or permanence of the data processing activity, and the geographical extent of the processing activity.

Then, regular means one or more of the following: ongoing or occurring at particular intervals for a particular period, recurring or repeated at fixed times, constantly or periodically taking place. Finally, systematic means one or more of the following: occurring according to a system, pre-arranged, organised or methodical, taking place as part of a general plan for data collection, carried out as part of a strategy.

Practical aspects

Core activities

Fundamental to an organization’s primary purpose, core activities that require a Data Protection Officer (DPO) are closely tied to personal data processing. For example, hospitals must process patient health records to provide healthcare, and private security companies must handle personal data for their surveillance work.

In contrast, essential supporting functions like payroll or IT support are considered ancillary activities and typically do not require a Data Protection Officer (DPO), even though they are necessary for the organization’s operations.

Large-scale processing

In any event, the following factors, in particular, be considered when determining whether the processing is carried out on a large scale:

• the processing of patient’s data as part of the day-to-day activities of a hospital.
• the processing of customer data in the context of day-to-day activities of an insurance company or a bank.
• the processing for statistical purposes of current location data of customers of an international fast-food chain by a subcontractor specialised in such services.
• processing of personal data for behavioural advertising by a search engine.
• the processing of data (content, flow, location) by telephone and Internet service providers.

Examples of processing that would not be considered as large-scale:

• processing of patient data by a single general practitioner.
• processing of personal data relating to convictions and offences by an individual lawyer.

Regular and systematic monitoring

For example, regular and systemic monitoring covers email retargeting; data-driven marketing activities; profiling and scoring for purposes of risk assessment (e.g. for purposes of credit scoring, establishment of insurance premiums, fraud prevention, detection of money-laundering); location tracking (for example, by mobile apps); loyalty programs; behavioural advertising; monitoring of wellness, fitness and health data via wearable devices; CCTV; connected devices (e.g. smart meters), smart cars, home automation, etc.

As such, a processor having as core activity to provide website analytics services and assistance with targeted advertising and marketing will have to appoint a DPO.

You can voluntarily appoint a Data Protection Officer (DPO), even if it’s not legally required. In doing so, you must comply with all GDPR provisions regarding the tasks and position of the DPO. Therefore, only assign the title of DPO to someone whose role and position align with the GDPR description.

Who can fulfil the role of a DPO?

The General Data Protection Regulation (GDPR) provides flexible options for appointing a Data Protection Officer (DPO), allowing organizations to engage either an individual professional or an external organization specializing in data protection compliance. When selecting an external service provider, organizations must rigorously ensure:

Key Independence Requirements

• Structural Independence

1. No conflicts of interest among service providers
2. Protection against arbitrary contract termination
3. Safeguarding individual team members from unfair dismissal related to DPO activities

• Operational Autonomy Organizations are explicitly prohibited from:

1. Instructing the DPO on how to perform their specific duties
2. Penalizing or dismissing the DPO for executing their professional responsibilities
3. Attempting to influence the outcome of data protection investigations or assessments

Reporting and Engagement Principles

The DPO must be:

• A strategic discussion partner integrated into critical organizational processes
• Directly reporting to the highest management level
• Involved in all data processing activity discussions
• Positioned as an independent advisor, not an executive decision-maker

Preventing Conflicts of Interest

To maintain independence, a DPO cannot simultaneously hold positions that:

• Determine the purposes of personal data processing
• Directly manage organizational data activities

Restricted Positions Include

• Chief Executive Officer
• Chief Operating Officer
• Chief Financial Officer
• Head of Human Resources
• Head of Information Technology
• Managing Director

Any additional organizational roles must be carefully evaluated to prevent potential conflicts that could compromise the DPO’s objectivity and effectiveness.

For more examples you can also check the European Data Protection Board (EDPB) guide for small business.

Strategic Considerations

While the GDPR allows flexibility in DPO appointment, the core principle remains consistent: the DPO must be able to perform their critical compliance and advisory functions with complete professional independence and integrity.

Conclusion

In an era of increasing digital complexity and heightened privacy concerns, the Data Protection Officer (DPO) has emerged as a crucial guardian of organizational integrity and individual privacy rights. Far beyond a mere compliance role, the DPO represents a strategic bridge between technological innovation, legal requirements, and ethical data management.

Strategic Significance

• The DPO is not just a regulatory requirement but a vital risk management function
• Provides proactive protection against potential data breaches and legal complications
• Ensures organizations maintain trust with customers, partners, and regulatory bodies

Multifaceted Responsibilities

• Acts as an independent advisor
• Monitors complex data processing activities
• Serves as a critical link between the organization, data subjects, and regulatory authorities
• Transforms data protection from a legal obligation to a competitive advantage

Future Outlook

As data becomes increasingly valuable and complex, the role of the DPO will continue to evolve. Organizations that view the DPO as a strategic partner rather than a compliance checkbox will be best positioned to:

• Mitigate risks
• Build customer trust
• Demonstrate ethical data practices
• Navigate increasingly sophisticated regulatory landscapes