Not every organisation needs a data protection officer, and a good many that have appointed one have appointed the wrong person. The role is defined in law, carries statutory protections, and cannot be held by someone whose other duties conflict with it — which rules out, in most organisations, the IT director, the head of marketing and the chief executive.
Who is actually required to appoint one
Under the UK GDPR, a DPO must be appointed where the organisation is a public authority or body; where its core activities require regular and systematic monitoring of data subjects on a large scale; or where its core activities consist of large-scale processing of special category data or data relating to criminal convictions.
Two words do the work. Core activities means processing that is integral to what the organisation does, not incidental support — an employer processing its own payroll is not, by that fact, required to appoint a DPO. Large scale is not defined numerically, and is assessed on the number of data subjects, the volume and range of data, the duration and the geographical extent.
Organisations outside those triggers may appoint voluntarily, and many do because a customer or an insurer asked. The point to understand before doing so: a voluntary DPO is subject to the same statutory requirements as a mandatory one. You cannot appoint a DPO in name and then treat the role informally.
What the role requires, and why internal appointments fail
The statutory position has three features that internal appointments frequently breach.
Independence. The DPO must not receive instructions on how to carry out the role, must report to the highest management level, and cannot be dismissed or penalised for performing their tasks. That is a genuine protection, and it sits awkwardly with an ordinary employment relationship.
No conflict of interest. The DPO cannot hold a position that involves determining the purposes and means of processing. That excludes, in most structures, the head of IT, the head of HR, the head of marketing and any senior executive — because each of them decides how personal data gets used, and the DPO's job is to advise on and monitor those decisions.
Expertise and resources. The DPO must have expert knowledge of data protection law and practice, proportionate to the processing, and must be given the resources and access to carry out the tasks and maintain that expertise.
The tasks themselves are defined: inform and advise the organisation and its staff of their obligations; monitor compliance, including awareness-raising and audits; advise on data protection impact assessments and monitor their performance; cooperate with the ICO; and act as the contact point for the ICO and for data subjects.
Why organisations outsource it
The law expressly permits the DPO to be an external service provider, and for mid-sized organisations that is frequently the more workable answer.
Independence and conflict become easier to demonstrate, though not automatically solved — an outsourced DPO has to meet exactly the same requirements, and a provider with its own commercial relationship with the organisation can carry a conflict of its own. Expertise is bought at the level required rather than developed internally. Cost is a fraction of a senior hire, and continuity does not depend on one person's tenure. And an external appointee often finds it easier to write down an uncomfortable conclusion about a project the commercial director is sponsoring.
Be fair to the alternative, though: an internal DPO is entirely capable of satisfying the law. The requirements are expert knowledge proportionate to the processing, adequate time and resources, a reporting line to the highest level of management, freedom from instruction on how to perform the role, and no other duties that determine the purposes and means of processing. An existing employee whose other responsibilities clear that last hurdle can hold the role properly. Outsourcing is a way of meeting the requirements, not a shortcut past them — and either way the organisation keeps its own accountability, which the appointment never transfers to the DPO.
The limitations are real too. An external DPO is not embedded, so the arrangement only works where they are genuinely included: brought into projects early, given access to the people who decide things, and present at the governance forum where processing decisions are made. An outsourced DPO consulted once a quarter is a compliance ornament.
What to look for, and what to avoid
- Named individual, not a helpdesk. The organisation must publish the DPO's contact details and notify the ICO; a rotating pool cannot build the knowledge of your processing that the role requires;
- Defined time commitment and response times, with scope for the peaks that a breach or a subject access request produces;
- A conflict check on the provider. A firm that also builds your systems or runs your marketing has the same conflict an internal appointee would;
- Insurance and a clear liability position — noting that accountability under the legislation stays with the controller regardless of who advises;
- An annual programme, not just an inbox: record of processing reviewed, DPIAs, training, supplier due diligence, retention schedule, and a report to the board.
The work that surrounds it
Appointing a DPO does not create compliance. The record of processing activities, the lawful basis analysis, the retention schedule, the DPIA process, the breach procedure with its 72-hour notification clock, the subject access process with its one-month deadline, and the contracts with processors all have to exist — the DPO advises and monitors, they do not build it single-handedly.
Organisations that get value from the role treat it as the assurance layer over a programme somebody else owns. Organisations that do not have appointed a DPO instead of doing the work.
Acumon supports data protection through GDPR audit work and the wider control environment covered by IT risk and cyber security audit services. If you appointed a DPO who also runs your IT, that is a conflict worth resolving before the ICO notices it.