"Do you have a DPO?" It's a question companies hear more and more often — from large clients, from partners, sometimes from the authority itself. And it's often followed by an awkward pause, because not everyone knows what those three letters actually mean.
So let's clear it up. No dry quotes from the law, no jargon.
What DPO means, in plain words
DPO stands for Data Protection Officer. It is the person (or, when outsourced, the firm) who makes sure an organisation treats people's data correctly: the data of customers, of employees, of anyone who leaves a piece of personal information behind.
The role isn't a marketing invention. It is written, in black and white, into the GDPR — in Articles 37, 38 and 39. That's where you find when a DPO is needed, what position they must hold inside the organisation, and what they have to do.
The simplest way to picture it: the DPO is like a trusted advisor on the data side. They don't run the company, but they tell you early where you're stepping wrong and how to avoid a fine or a loss of trust.
What a DPO's tasks are
Article 39 of the GDPR lists, briefly, what a DPO does. Here it is in everyday language.
- Informs and advises. Explains to people in the company — from management to the person answering the phone — what their obligations are when working with personal data. They're the first person you ask "am I allowed to do this?".
- Checks that the rules are followed. Looks at how data is actually used, not just on paper: who has access, how long it's kept, how it's protected. Flags what isn't right.
- Helps assess risks. When an activity could seriously affect people's privacy, you run an analysis called a DPIA. The DPO advises on how to do it and what to watch for.
- Acts as the contact point. For the people whose data is used and for the authority. If someone wants to see or delete their data, the DPO is the address.
- Cooperates with the authority. If an investigation or a data breach comes up, the DPO keeps in touch with the authority and helps with the response.
One more important detail: the DPO works with a sense of risk. They don't put the same pressure on a newsletter list as on a medical database. Where the stakes for people are high, their attention goes up.
When a DPO is mandatory
Not every company is required to have a DPO. The law calls for one in three cases (Art. 37):
- You are a public authority or body (with a small exception for courts).
- You monitor people's behaviour systematically and on a large scale — for example, extensive video monitoring or tracking users online.
- You use special-category data on a large scale — health data, criminal records and the like.
Otherwise, you can appoint a DPO voluntarily. Many do, because a serious partner asks for it, or simply for the peace of mind of knowing someone keeps an eye on this side of things.
In-house or outsourced DPO?
The DPO can be an employee of the company or an outside person or firm hired for the job. The law accepts both. For small and medium businesses, the outsourced option is often more practical: you get up-to-date expertise without paying a full salary, and without the risk that your "GDPR person" is actually busy with something else. You'll find the details on our Outsourced DPO page.
Whichever you choose, two conditions stay the same: the DPO must be independent (no one dictates their conclusions) and free of any conflict of interest (they can't be, say, the head of IT who decides everything they would then have to check).
What a DPO does NOT do
This is where most of the confusion comes from, so it's worth saying clearly:
- They don't decide how data is used. That stays with the organisation. The DPO advises; management chooses and is responsible.
- They don't pay the fines. Legal responsibility is the company's (the data controller's), not the officer's. They're not the scapegoat.
- They're not just a name on a form. A DPO who exists only on paper protects you not at all — it's actually a risk, because it gives the impression you're covered.
In conclusion
A good DPO isn't a compliance checkbox. They're the person who turns the rules into simple steps, warns you before the problem shows up, and speaks to the authority on your behalf when needed. And when the role is taken seriously — in-house or outsourced — it shows: fewer surprises, more trust from clients and partners.
Frequently asked questions
What does DPO mean?
DPO stands for Data Protection Officer. It is the person who makes sure an organisation uses people's data correctly and in line with the GDPR. The role is set out in Articles 37-39 of the GDPR.
What are a DPO's tasks?
Informing and advising management and staff about their obligations, checking that the rules are followed, helping with risk assessments (DPIA), acting as the contact point for people and for the authority, and cooperating with it. In short: guide, check and keep in touch.
When is a DPO mandatory?
When you are a public authority or body, when you monitor people's behaviour systematically and on a large scale, or when you process special-category data (health, criminal records and so on) on a large scale. Otherwise, you may appoint one voluntarily.
Is the DPO liable for fines?
No. Legal responsibility stays with the organisation (the data controller). The DPO advises and checks, but does not decide how data is used and is not fined in the company's place.
Need a DPO but don't want to hire someone?
We provide an outsourced Data Protection Officer: guidance, regular checks, a contact point with the authority and the peace of mind that someone is actually on it — without the cost of an extra employee.