Data Protection Officer (DPO)

What is a data protection officer (DPO)?

A data protection officer (DPO) is the person who advises a company on data protection law, checks that it follows that law, and acts as the contact point for regulators and for the people whose data it holds. The role is set out in Articles 37 to 39 of the GDPR. The UK kept the same articles in the UK GDPR.

The DPO advises; the company decides. The Guidelines on DPOs written by the Article 29 Working Party (the group of EU regulators that preceded the European Data Protection Board), last revised on 5 April 2017 and endorsed by the EDPB on 25 May 2018, say DPOs are not personally responsible when a company breaks the rules. Compliance stays with the controller (the company that decides why and how data is used) or the processor (the company that handles data on its behalf).

When you must appoint one

Under Article 37, a controller or processor must appoint a DPO in three cases:

• It is a public authority or body, except courts acting in their judicial role.
• Its core activities involve regular and systematic monitoring of people on a large scale.
• Its core activities involve large-scale processing of special category data, such as health data, or data about criminal convictions and offenses.

The law does not define most of these words. The guidelines fill the gaps:

• Core activities are the key operations a company needs to reach its goals. Paying staff and standard IT support are support functions, so they do not count on their own.
• Large scale has no fixed number. Regulators weigh the number of people affected, the volume and range of data, how long the processing lasts and how wide an area it covers.
• Regular and systematic monitoring includes all forms of tracking and profiling on the internet, including for behavioral advertising. The guidelines' examples include email retargeting, data-driven marketing, location tracking by mobile apps and loyalty programs.

The test applies to processors too, and the answers can differ. In one example in the guidelines, a small local business does not need a DPO, but its website analytics and ad-targeting provider does, because the provider's work for many such clients adds up to large-scale processing. EU countries can also require a DPO in more cases under Article 37(4).

If the answer is not obvious, the guidelines recommend writing down your analysis and updating it when you start new activities.

What a DPO does

Article 39 lists the minimum tasks:

• Inform and advise the company and its staff about their data protection duties.
• Monitor compliance, including assigning responsibilities, training staff and running related audits.
• Advise, when asked, on data protection impact assessments and monitor how they are carried out.
• Cooperate with the regulator and act as its contact point.

Article 38 protects the role. The company must involve the DPO "properly and in a timely manner" in all data protection issues and give them the resources they need. It may not tell the DPO how to carry out those tasks, and it may not dismiss or penalize the DPO for doing them. The DPO reports directly to the highest management level. The DPO can be an employee or an outside provider under a service contract, and one DPO can serve a group of companies if easily reachable from each one.

Conflicts of interest

A DPO may have other duties, but Article 38(6) says they must not create a conflict of interests. According to the guidelines, the DPO cannot hold a role that decides the purposes and means of processing. Their examples of likely conflicts include chief executive, chief operating officer, chief financial officer, and head of marketing, HR or IT. In its X-Fab Dresden judgment of 9 February 2023 (Case C-453/21), the EU Court of Justice held that a conflict may exist where the DPO's other duties would have them determine the objectives and methods of processing, and that a national court must decide this case by case on all the circumstances, including how the company is organized.

On 12 September 2025, Poland's data protection authority fined a medical services company 2,700 euros under Article 38(6) because its chairman was also its DPO.

What it looks like in a vendor's terms

In vendor paperwork, the DPO usually shows up as a contact. Article 13 requires a privacy notice to give the DPO's contact details where there is one, and Article 37(7) requires the details to be published and sent to the regulator. A typical clause in a data processing agreement (DPA) reads like this:

Each party has appointed a data protection officer where required by Data Protection Laws. Processor's data protection officer can be reached at the contact details set out in Annex 1. Processor may update these details by giving notice to Customer.

• "Where required by Data Protection Laws": the vendor appoints a DPO only if the law makes it. It may have none and name a privacy team instead.
• "Can be reached at": your route for questions about subprocessors, breaches and audits. The guidelines allow this to be a role address; the published details do not have to name the person.
• "May update these details by giving notice": the contact can change. Check how that notice reaches you.

Why it matters to you

Getting the DPO rules wrong is a breach in its own right. Under Article 83(4), failures under Articles 37 to 39 can bring fines of up to 10 million euros or 2% of worldwide annual turnover, whichever is higher.

Regulators are looking. In 2023, 25 data protection authorities across the European Economic Area ran a coordinated review of DPOs. Their report, adopted on 16 January 2024, found DPOs missing where they were mandatory, short of resources and training, holding conflicting roles, and not reporting to top management, and said the 2017 guidelines should be developed further.

Even if you do not need a DPO, someone at your company does the work. Customers send you DPAs that ask for your data protection contact. Your vendors' DPOs are the people you go to when their data handling changes. And a lot of the work is about vendors: which ones hold your data, where they send it and what changed in their terms.

What to check

• Your own need: Test your core activities against the three cases in Article 37, write down the result, and redo it when you launch a feature that tracks or profiles users.
• Conflicts: If you appoint a DPO, check that they do not also decide how data is used, for example as CEO or head of IT. An outside DPO is one way around this.
• Reporting line and time: The DPO reports to the highest management level and has the time and budget the job needs. The guidelines give an annual report to management as an example.
• Published contact: Your privacy policy gives the DPO's contact details, and the regulator has them.
• Representative: A DPO is not the representative that a company with no EU establishment may need under Article 27. Check whether you need one, the other or both.
• Records: The guidelines note that DPOs often keep the company's records of processing activities, though the legal duty stays with the company.
• Vendors' contacts: Each key vendor's DPA or privacy policy names a DPO or privacy contact, and that contact still works.
• Vendor changes: Someone owns reviewing changes to vendors' DPAs and subprocessor lists.

How Venpo helps

Much of a DPO's vendor work is reading other companies' paperwork. Venpo watches the public legal documents of your vendors, including privacy policies, DPAs and subprocessor lists, and emails a plain-English alert when one changes, with what changed and why it matters. That includes the new subprocessors you need to review and a vendor's changed privacy contact.

Each vendor gets a change history with a redline of every change, so you can show a regulator or a customer what a document said and when it changed.