# Data protection officer (DPO)

The independent expert some organisations must appoint to advise on and monitor their compliance with UK GDPR and EU GDPR.

Source: https://sted.digital/docs/glossary/data-protection-officer · Last reviewed 17 October 2026 · Strand Glossary

A data protection officer (DPO) is the independent expert an organisation appoints to advise it on data protection law, monitor its compliance and act as the contact point for the regulator and the public. Public bodies must have one, and so must organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data.

## Where the term appears

UK GDPR Article 37(1) and EU GDPR Article 37(1) set the three cases where a DPO is mandatory: processing by a public authority, core activities that need regular and systematic monitoring of people on a large scale, and core activities built on large-scale special category or criminal offence data. UK GDPR Article 38 protects the role and UK GDPR Article 39 lists the tasks; EU GDPR uses the same numbers. The UK reforms of 2025 left the duty in place. The [GDPR overview](/docs/standards/gdpr) shows where the role fits.

### Independent, or not a DPO

Auditors test the conflict of interest first. A DPO reports to the highest level of management, cannot be told how to do the job or penalised for doing it, and cannot hold a role that decides why and how data is processed, which usually rules out the chief executive and the head of IT. If you appoint one voluntarily, the same rules apply, so many smaller organisations name a privacy lead instead.

## How Sted uses it

Sted's Personal Data Protection Policy (POL-PDP) has its own sections on lawful basis, special category data, individuals' rights, security, processors and international transfers, records of processing and the data protection officer, each tagged to the UK GDPR and EU GDPR requirements it meets.

Sted does not act as your data protection officer. Your organisation appoints its own, where the law requires one or you choose to.

## Related terms

- [Records of processing activities (ROPA)](/docs/glossary/records-of-processing): names the DPO's contact details.
- [Data protection impact assessment (DPIA)](/docs/glossary/dpia): must seek the DPO's advice.
- [Special category data](/docs/glossary/special-category-data): large-scale use is one of the triggers.
- [Subject access request (DSAR)](/docs/glossary/subject-access-request): people often send these to the DPO.