The meaning of DPO in UK data protection law is specific. A data protection officer is the person who monitors how an organisation handles personal data and advises it on its obligations, and the role has its own legal duties under Articles 37 to 39 of UK GDPR. Some organisations must appoint one. Others can choose to, and a voluntary appointment carries the same requirements as a mandatory one.

What a Data Protection Officer Does Day to Day

A DPO monitors compliance with data protection law, advises the organisation and its staff on their obligations, and advises on data protection impact assessments when a new project or system is likely to put people’s privacy at risk. They also raise awareness and train staff, and they act as the contact point for the people whose data is being processed and for the regulator. That regulator is now the Information Commission, which took over from the Information Commissioner’s Office (ICO) on 30 September 2026. In a larger organisation the DPO may have a small team behind them so that casework does not fall on one person.

The DPO advises. The organisation remains responsible for complying with the law.

Who Needs One

UK GDPR requires a DPO if you are a public authority or public body. It also requires one if your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special category data or criminal offence data. Special category data includes health data and biometric data used to identify people. Core activities means the processing that is central to what you do. Processing that is incidental to the business, such as paying your own staff, does not count on its own.

You can also appoint a DPO when the law does not require it, but the guidance says a voluntary DPO carries the same requirements as a mandatory one, including independence and access to senior management. If you want specialist advice without taking on those obligations, give the person a different job title. Whichever way you decide, record your reasoning. The guidance says documenting a decision not to appoint is a good idea.

Independence

A DPO must be able to give their advice without being told what conclusion to reach. They need expert knowledge of data protection law and practice, enough time and resources to do the work, and a direct line to the highest level of management. They cannot be dismissed or penalised for doing the job. The role stops working when the DPO reports through someone with a stake in the outcome.

A DPO can have other duties, but not ones that conflict with the role. Someone who decides how and why personal data is used, such as the head of IT, HR, or marketing, is poorly placed to advise on those same decisions.

In-House, External, or Shared

A DPO can be an employee or an external person or firm engaged under a service contract. A group of companies can appoint a single DPO as long as they are easily accessible to each business in the group. An external DPO can also act for several clients, provided they have the time and access to do the job properly for each. What matters is the expertise, independence, and access to leadership the function requires, whatever the contract looks like.

Where This Overlaps With Wider Security Work

A DPO’s advice on impact assessments usually covers the same ground as security risk work, including how systems are designed, where data is stored, and which controls protect it. The security framework you build your compliance around shapes how that advice gets implemented. The same applies to the cloud. A DPO cannot advise properly on personal data held in your cloud environment without knowing how it is configured and secured.

Getting the Scope Right Before You Appoint Anyone

Before appointing a DPO, whether internally or externally, work out what personal data you process, how much of it is high risk, and how much ongoing advisory support that needs. A DPO without the authority or resources to do the job is a paper exercise and gives you no real protection. The guide to data protection officers covers when the requirement applies and what the role needs to look like. It is under review following the Data (Use and Access) Act, so check it for updates.

If you are working out how AI tools and personal data intersect, speak to an AI privacy consultant before those systems go live.