What is DPO (Data Protection Officer)?

GDPR mandates a DPO in three cases: for public authorities; where core activities consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale; and where core activities consist of large-scale processing of special-category data or criminal-conviction data. Ad-tech businesses, platforms with pervasive behavioral tracking, and health-data processors typically qualify; a small store with routine customer records typically does not — though many organizations appoint one voluntarily, and once appointed, all the statutory rules apply.

The role is defined by independence. The DPO reports to the highest level of management, cannot be instructed how to interpret the law or penalized for their advice, and must be free of conflicting duties — which is why courts and regulators have found that a head of marketing or IT usually cannot double as DPO. The organization must involve the DPO 'properly and in a timely manner' in all data protection matters and publish the DPO's contact details, registering them with the supervisory authority.

The statutory tasks: inform and advise on GDPR obligations, monitor compliance including audits and training, advise on and monitor data protection impact assessments, cooperate with the supervisory authority, and act as its contact point. The DPO advises and monitors; accountability for decisions stays with the controller.

The function can be outsourced — 'DPO as a service' is a mature market — and one DPO can serve a corporate group if accessible from each establishment. US state laws do not require a DPO, though several require documented privacy programs and data protection assessments that in practice need an owner.