Data protection officer (DPO): what the role is and does

A DPO is a role the GDPR and the UK GDPR require some organisations to fill. The person can be a staff member or an outside contractor, and the organisation must publish their contact details and give them to the supervisory authority (in the UK, the ICO).

Who has to appoint one

Article 37 of the GDPR says a controller or processor must designate a DPO in three cases: it is a public authority or body (courts acting in their judicial role excepted); its core activities involve regular and systematic monitoring of people on a large scale; or its core activities involve large-scale processing of special categories of data (such as health data) or data about criminal convictions. Other organisations may appoint one voluntarily.

The DPO is chosen for professional qualities, in particular expert knowledge of data protection law and practice. A group of companies can share one DPO if that person is easy to reach from each establishment.

What a DPO does

The ICO describes the job as helping the organisation monitor its internal compliance, informing and advising it on its data protection duties, advising on data protection impact assessments (DPIAs), and acting as a contact point for individuals and for the regulator. In practice that means a DPO is also the person to write to when you want to use your rights, such as asking what a company holds about you or asking it to delete your data.

A DPO is not the same as the controller

The controller is the organisation that decides why and how your data is used, and it stays legally responsible. The DPO advises and checks. A DPO also isn't a general privacy officer or a security engineer, although some organisations give one person several of those jobs.

Why it matters to you

If a company holds your data and you can't tell who to contact, look for the DPO's address in its privacy notice. Organisations that must appoint one are required to publish it, so a request sent there reaches someone whose job is to handle it.

How to protect yourself

Find the DPO's contact details

Check the company's privacy notice or privacy policy. Where a DPO has been appointed, the contact details should be listed there.

Put your request in writing

Email the DPO or the privacy address, say which right you are using (access, erasure, objection), and keep a copy with the date you sent it.

Escalate to the regulator if you get nowhere

If the organisation doesn't answer or refuses without good reason, you can complain to your data protection authority. In the UK that is the ICO.

Cut down what companies hold in the first place

The fewer firms that list your address and phone number, the fewer requests you have to send. Serus finds where your address and phone number are listed and removes them for you.

Frequently asked

Does every company need a data protection officer?

No. Under Article 37 of the GDPR it is required for public authorities, for organisations whose core activities involve large-scale regular and systematic monitoring of people, and for those whose core activities involve large-scale processing of special categories of data or criminal conviction data. Others can appoint one if they choose.

Can a data protection officer be an outside contractor?

Yes. Article 37 says the DPO may be a staff member or may do the job under a service contract.

Who does a data protection officer report to?

The organisation must publish the DPO's contact details and tell the supervisory authority who they are. The ICO describes the DPO as the contact point for individuals and the regulator, and as the person who advises the organisation on its duties.

Can I contact a company's DPO directly?

Yes. Individuals can contact the DPO, and the ICO lists acting as a contact point for individuals as one of the DPO's tasks.

What is a data protection officer?