What is a data protection officer, and when must you appoint one?
A data protection officer (DPO) is an independent expert who advises on and monitors your compliance and is the contact point for people and the regulator. You must appoint one if you are a public authority, or if your core activities involve large-scale regular and systematic monitoring of people, or large-scale processing of special category or criminal offence data.
What it is
The DPO must have expert knowledge of data protection law and practice, report to the highest level of management, and not be instructed how to carry out their tasks or dismissed or penalised for performing them. The role can be filled by an employee or an external provider, and a group can share one DPO. The DUAA 2025 left these rules unchanged.
When you must appoint one
- You are a public authority or body, other than a court acting judicially. UK GDPR Art 37(1)(a); DPA 2018 s.7
- Your core activities need regular and systematic monitoring of people on a large scale, such as online tracking or loyalty schemes. Art 37(1)(b)
- Your core activities involve large-scale processing of special category or criminal offence data, such as a hospital or a screening company. Art 37(1)(c)
When you do not have to
- Where none of the three triggers applies. You may still appoint one voluntarily, and the same rules then apply to the role.
- Where processing is only ancillary to your core activities, such as payroll or IT support.
Who is responsible
The controller or processor. It must publish the DPO's contact details, tell the regulator, involve the DPO properly and in good time, give them resources, and avoid conflicts of interest with their other duties.
What it involves
- Assess the three triggers and record the decision.
- Appoint someone with the expertise and independence required.
- Publish contact details and notify the regulator.
- Give the DPO resources and access to senior management.
- Involve the DPO in DPIAs, breaches and rights requests.
If it goes wrong
- Regulatory
- Failing to appoint a required DPO, or undermining their independence, breaches Arts 37 to 39. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.
- Criminal
- No offence.
- Civil
- No freestanding claim, but the missing oversight can support a compensation claim under Art 82 where processing causes damage.
Go further
- The law
- UK GDPR, DPA 2018
- Guides
- The DPO, and data ownership beyond it, Stewardship and the operating model
- Glossary
- Data protection officer
More on duties on organisations
- What is a UK representative, and who needs one?
- What is the data protection fee, and do you have to pay it?
- What is a privacy notice, and what must it say?
- What is a data processing agreement, and when is one required?
- What is a data sharing agreement, and when should you have one?
- What is data protection by design and by default?
Sources
- Primary UK GDPR, Article 37 legislation.gov.uk
- Primary UK GDPR, Article 38 legislation.gov.uk
- Primary UK GDPR, Article 39 legislation.gov.uk
- Primary Data Protection Act 2018, section 7 legislation.gov.uk
Updated