Glossary term
Data Protection Officer (DPO)
Subject: Technology, Cyber and Data, Data Protection and Privacy
A data protection officer is a designated person who advises an organisation on its privacy duties, monitors compliance, and acts as the contact point for regulators and individuals, while staying independent of day-to-day decisions.
Explanation
Under the GDPR the role is mandatory only in set cases: public authorities, organisations whose core activity involves regular and large-scale monitoring of people, and those handling sensitive data on a large scale. Others may appoint one voluntarily. The DPO needs expert knowledge of data protection law, reports to the highest management level, receives no instructions about how to do the job, and cannot be penalised for giving advice. The officer may be an employee or an outside contractor, and one person can serve a group. Tasks include advising on impact assessments, training staff, monitoring compliance and cooperating with the supervisory authority. The DPO advises; management stays accountable. Conflicts arise if the DPO also decides how data is used. Management may choose against the DPO's advice, though the officer's view is then on record.
Example
A large hospital group appoints a DPO because it processes patient health data at scale. When the IT team proposes sharing records with a research partner, the DPO asks for an impact assessment and notes a gap in patient notices. Management chooses to delay the project until the notice is updated.
Not to be confused with
- Chief Information Security Officer
- Leads technical security. A DPO oversees lawful use of personal data and reports without taking orders on how to perform that task.