When you need a DPO
A data protection officer is mandatory for public authorities, for core activities involving regular and systematic monitoring on a large scale, or large-scale special-category or criminal-conviction data. Otherwise it is voluntary — but a voluntary DPO carries the same statutory protections.
Why it is like this
The trigger is drawn around organisations whose business *is* the data, rather than around headcount, so that a small adtech firm is covered and a large bakery is not.
Not to be confused with
A compliance manager by another name. The DPO must report to the highest management level, cannot be instructed on how to perform the role, cannot be dismissed for doing it, and must not hold a role that sets the purposes of processing.
In practice
A head of IT or a general counsel as DPO is usually a conflict of interest: both decide purposes and means for processing they would then have to supervise.
Source: Regulation (EU) 2016/679 (GDPR) — Article 37 to 39. Read on .
Odd one out Check yourself
Three of these are protections the regulation gives a DPO. Which one is not?
Show the answer
Is personally liable for the controller's non-compliance
The DPO advises and monitors; the controller remains responsible. Making the DPO personally liable would destroy the independence the other three protect.