What a Data Protection Officer does
A Data Protection Officer (DPO) is the accountable point of expertise for personal data processing inside an organisation. The role is advisory and supervisory, not operational: a DPO informs, monitors, advises and cooperates with the regulator, but does not decide the purposes of processing. That separation is what preserves the role's independence.
When appointment is mandatory
Under the GDPR, a DPO is required when:
- The processing is carried out by a public authority or body
- Core activities consist of processing that requires regular and systematic monitoring of individuals on a large scale
- Core activities consist of large-scale processing of special category data, or of personal data relating to criminal convictions and offences
Under India's DPDP Act, 2023, a DPO is required of any Data Fiduciary notified as a Significant Data Fiduciary. That DPO must be based in India, must be an individual responsible to the board of directors or similar governing body, and must serve as the point of contact for the grievance redressal mechanism. Every other Data Fiduciary still has to publish the contact details of a DPO or of another authorised person able to answer questions about its processing.
Many organisations appoint voluntarily. Where processing is contentious, high-volume or cross-border, a named owner reduces response times and regulatory friction even when no rule compels it.
Core responsibilities
- Advise and inform the controller, processor and employees of their obligations
- Monitor compliance with the applicable law, internal policies and contractual privacy commitments
- Own the record of processing and keep the data inventory and flow maps current
- Advise on Data Protection Impact Assessments and monitor their performance and outcomes
- Manage rights requests and grievances end to end, with defined SLAs and evidence
- Coordinate breach response — assessment, notification decisions and regulator correspondence
- Govern processors and transfers — contract clauses, due diligence and cross-border conditions
- Run training and awareness for high-risk functions such as marketing, HR, support and engineering
- Cooperate with the supervisory authority and act as its contact point
- Report to the highest management level on privacy risk and programme status
Independence and conflict of interest
Three constraints define a defensible appointment:
- No instructions on how to perform the task, and no dismissal or penalty for performing it
- Direct reporting to the highest management level, not buried under a function whose decisions the DPO must review
- No conflicting role — a DPO cannot determine the purposes and means of processing, so heads of marketing, HR, IT or operations are generally unsuitable
Sufficient resources, access to processing operations, ongoing training and an adequate time allocation are part of the legal expectation, not a courtesy.
Skills that actually matter
| Competency | Why it is needed |
|---|---|
| Privacy law fluency | Interpreting GDPR, DPDP, sectoral rules and contractual commitments consistently |
| Information security literacy | Judging whether safeguards are genuinely reasonable, and working credibly with engineering |
| Process and control design | Turning obligations into workflows, retention jobs and auditable evidence |
| Risk assessment | Performing DPIAs and prioritising remediation against real harm to individuals |
| Communication and influence | Advising without authority, and training functions that resist friction |
In-house, shared or outsourced
- In-house DPO — best where processing is complex, continuous and central to the business model. Highest context, highest cost.
- Group or shared DPO — a single DPO may serve a group of undertakings provided they remain accessible from each establishment; watch for capacity and language coverage.
- Outsourced or virtual DPO — an external expert or firm performs the role under contract. Efficient for mid-sized organisations; requires clear scope, response SLAs, escalation routes and evidence that the provider has the independence and access the role demands. Where an India-based individual responsible to the board is mandated, verify that the arrangement satisfies that condition.
Setting the role up to succeed
- Define the appointment in writing — mandate, reporting line, resources, independence protections
- Publish contact details and register them with the supervisory authority where required
- Stand up the operating cadence — inventory refresh, DPIA pipeline, rights queue, breach drills, board reporting
- Instrument the programme — SLA metrics for rights requests, training coverage, open remediation, processor assurance
- Align to a framework — ISO/IEC 27001 for security controls, ISO/IEC 27701:2025 for privacy-specific extensions, so the DPO reports against operating evidence rather than opinion
Key takeaways
- Mandatory under GDPR for public authorities, large-scale monitoring and large-scale special category processing
- Mandatory under the DPDP Act for Significant Data Fiduciaries, with an India-based individual accountable to the board
- The role is advisory and supervisory — it must not decide processing purposes
- Independence, direct board reporting and freedom from conflicting duties are legal requirements
- An outsourced DPO is legitimate when scope, access, independence and residency conditions are contractually secured
A DPO without access, budget or a reporting line is a compliance liability rather than a control. Fix the mandate before filling the seat.