Glossary
Data protection officer (DPO)
The person designated under GDPR Articles 37 to 39 to advise on and monitor data protection compliance within an organisation.
A data protection officer (DPO) is designated under Articles 37 to 39 GDPR. Designation is mandatory under Article 37(1) for public authorities and bodies, and for controllers and processors whose core activities involve large-scale regular and systematic monitoring of data subjects or large-scale processing of special categories or criminal convictions data. Other organisations may appoint one voluntarily. The DPO's tasks under Article 39 include informing and advising the organisation, monitoring compliance, advising on DPIAs and acting as the contact point for the supervisory authority.
Article 38(1) requires the DPO to be involved properly and in a timely manner in all issues relating to the protection of personal data. Article 38(3) says the DPO must not receive instructions regarding the exercise of those tasks and must not be dismissed or penalised for performing them, and Article 38(6) requires that other duties do not create a conflict of interests.
For security and IT teams, the DPO is a key partner rather than a gatekeeper. The DPO should be in the loop early on new systems, DPIAs, monitoring tools and every suspected personal data breach. Some organisations consider combining the CISO and DPO roles, which can raise conflict-of-interest questions to review with legal counsel. See our guide to DPIAs for IT projects.