The DPO, and data ownership beyond it

A data protection officerData protection officerA protected adviser who monitors compliance and is the contact point for the regulator. Mandatory for public authorities and some large-scale processing. is a statutory role with a defined job. Data ownership is a governance role with a different one. Confusing them is the commonest reason a DPO ends up accountable for decisions they were never allowed to make.

When a DPO is mandatory

You must designate a DPO if:

• you are a public authority or body, except courts acting in a judicial capacity;
• your core activities involve regular and systematic monitoring of individuals on a large scale; or
• your core activities involve large-scale processing of special category or criminal offence data.

Core activities are what you exist to do, not support functions such as payroll. Large scale is judged on numbers, volume, duration and geography together. If you decide you do not need one, record why: it is a judgement a regulator may revisit.

The Data Protection and Digital Information Bill would have replaced the DPO with a “senior responsible individual”. That change was not carried into the Data (Use and Access) Act 2025: the DPO rules in Articles 37 to 39 are unchanged.

What the role must be free to do

• Involved early. The DPO must be involved properly and in a timely manner in all data protection issues.
• Resourced. Given the resources and access needed to do the job.
• Independent. Takes no instructions on how to perform their tasks, cannot be dismissed or penalised for performing them, and reports to the highest management level.
• No conflict. Cannot hold a role that determines the purposesDetermines the purposesThe test that separates a controller from a processor: who decides why the processing happens. Not who holds the data, who is larger, or what the contract calls them. and means of processing. A head of IT, marketing or HR is the classic conflict.
• Reachable. Contact details published and given to the regulator.

What the DPO does

Inform and advise; monitor compliance, including training and audits; advise on DPIAsDPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people.; cooperate with the regulator and act as its contact point. The DPO monitors. The controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. decides and is accountable.

Data ownership beyond the DPO

Most organisations need named owners for each significant dataset: the business lead who decides why it exists, who may use it and when it is deleted. Owners answer the questions the record of processing asks. Stewards maintain quality and definitions day to day. The DPO advises all of them and challenges when they are wrong.

For a complaint

Write to the DPO by name where one exists: it is the contact point the law provides, and their response, or silence, is evidence of how seriously the organisation takes the issue.