Data protection officer

Appointment is mandatory only in defined cases

A public authority or body must appoint a DPO, apart from courts acting judicially. Other organisations must appoint one when their core activities require large-scale regular and systematic monitoring, or large-scale processing of special category or criminal offence data.

Routine staff administration is usually ancillary rather than a small employer's core activity. Size alone neither creates nor removes the duty. The ICO's DPO guidance says organisations should document their decision, including a reasoned conclusion when they decide an appointment is not required.

Independence matters more than the job title

The DPO informs and advises, monitors compliance, supports data protection impact assessments, raises awareness and acts as a contact for the ICO and data subjects. They may be an employee or work under a service contract, and a group can share a DPO if the person remains accessible.

The organisation remains responsible for compliance. The DPO should report to the highest management level, receive adequate resources and not be penalised for performing the role. Other duties must not create a conflict, such as deciding the purposes and means of the processing they are meant to monitor.

Publish the route and preserve confidential access

Formal designation matters, not whether the appointment was mandatory. The ICO's DPO guidance says the same position and task requirements apply to a DPO appointed voluntarily. For either a mandatory or voluntary formal designation, publish the DPO's contact details and give them to the ICO. The route can use a role address rather than the individual's name.

An ordinary privacy lead is different. If someone coordinates privacy work without being formally designated as the DPO, use a title that does not imply the statutory role and record what authority and responsibilities they actually have.

Record advice and management decisions, especially when the organisation does not follow a recommendation. Involve the DPO early in new systems, monitoring, transfers, incidents and rights handling so their role is real rather than a final approval box.