DPO(DPO)
Strategy and planning
Strategy and planning
A DPO (Data Protection Officer) is the internal supervisor of how an organisation handles personal data.
The role comes from the GDPR. A DPO monitors compliance, advises on privacy questions, is the point of contact for data subjects and the supervisory authority, and reports independently to the board.
Public bodies and organisations that process special categories of personal data at scale or systematically monitor people are required to appoint a DPO. Many other organisations appoint one voluntarily, or have the role filled externally.
One important detail: a DPO advises and supervises but does not decide which processing takes place. That responsibility stays with the organisation itself.
In practice
Giving the DPO role to whoever also runs the systems or the marketing. Then they review their own work and independence is gone.
Related terms
- DPO-as-a-ServiceDPO-as-a-Service means outsourcing the Data Protection Officer role: a specialist fills it on a subscription basis for a few hours a month.
- ConsultancyConsultancy is paid advice from outside your organisation: a consultant analyses a question, advises on the approach and often helps with the execution too.
- InterimInterim means temporary: someone fills a role in your organisation for a defined period — during illness, parental leave, an open vacancy or a project that needs extra steering.