Data protection officer (DPO)

A data protection officer (DPO) is the independent expert an organisation appoints to advise it on data protection law, monitor its compliance and act as the contact point for the regulator and the public. Public bodies must have one, and so must organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data.

Short form

DPO

Clauses

UK GDPR Article 37(1) · EU GDPR Article 37(1) · UK GDPR Article 38 · UK GDPR Article 39

Where the term appears

UK GDPR Article 37(1) and EU GDPR Article 37(1) set the three cases where a DPO is mandatory: processing by a public authority, core activities that need regular and systematic monitoring of people on a large scale, and core activities built on large-scale special category or criminal offence data. UK GDPR Article 38 protects the role and UK GDPR Article 39 lists the tasks; EU GDPR uses the same numbers. The UK reforms of 2025 left the duty in place. The GDPR overview shows where the role fits.

Independent, or not a DPO

Auditors test the conflict of interest first. A DPO reports to the highest level of management, cannot be told how to do the job or penalised for doing it, and cannot hold a role that decides why and how data is processed, which usually rules out the chief executive and the head of IT. If you appoint one voluntarily, the same rules apply, so many smaller organisations name a privacy lead instead.

How Sted uses it

Related terms

• Records of processing activities (ROPA): names the DPO’s contact details.
• Data protection impact assessment (DPIA): must seek the DPO’s advice.
• Special category data: large-scale use is one of the triggers.
• Subject access request (DSAR): people often send these to the DPO.